fix(redirect): set redirect server port when enable http_to_https#6686
Conversation
…ttps Signed-off-by: kwanhur <[email protected]>
…ttps Signed-off-by: kwanhur <[email protected]>
|
@kwanhur IMHO specify a port is really hacky, what if users say we need to customize the host in the Location, instead of the one passed from the client? Do we need to add another Why not extend the |
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: kwanhur <[email protected]>
…eat-redirect-port
|
From plugin redirect docs, rule 1
"plugins": {
"redirect": {
"uri": "https://$host:9443$request_uri",
"ret_code": 301
}
}
To extend the other field, what about new attribute
|
It's a big change but not broken? Let's hear more voices from the community :) |
Looks like a breaking change here, discussion in mail list first in needed. |
|
@kwanhur Any updates? |
Not yet. I'm not agree with reusing Hopefully hear other voices. |
|
Indeed it's not a broken change, URI is an identifier for a resource, not a component of a URL (e.g., the path). Could you explain the details about the broken change? Oh, by the way, maybe we should talk about this on the mailing list. |
|
test case 21 shows the incompatibility Line 487 in dbe7eee Lines 515 to 516 in dbe7eee |
|
Thanks, that really change the rule, but on the other hand, even if we remove this limitation, all configurations set before can still be applied successfully in the new version. @spacewander What do you think? |
|
We also need to take some compatibility points on |
All of them are on the caller's side, could you give a specific example of the incompatibility? |
I can't catch up with the point. The new field is optional and it is not a break change? |
|
@kwanhur Another way is that we can check the X-Forwarded-Port in this plugin. |
Ok, I'll move on at |
Signed-off-by: kwanhur <[email protected]>
|
Have a glance at Using it means need to update the existed test cases, please note that. Line 668 in 4afc8a7 |
I think so, if the downstream really carries the |
…e http_to_https Signed-off-by: kwanhur <[email protected]>
Signed-off-by: kwanhur <[email protected]>
…ero or greater than 65535 Signed-off-by: kwanhur <[email protected]>
|
Three scenarios will force
|
Co-authored-by: 罗泽轩 <[email protected]>
Co-authored-by: 罗泽轩 <[email protected]>
|
Workflow failed on |
| core.log.info("plugin rewrite phase, conf: ", core.json.delay_encode(conf)) | ||
|
|
||
| local ret_code = conf.ret_code | ||
| local ret_port = tonumber(ctx.var["var_x_forwarded_port"]) |
There was a problem hiding this comment.
Recently, I upgraded apisix with the latest code, and found that there was an error in converting http to https. When redirecting, I always bring a port 80. It should be caused by this change, because I am listening on port 80 and port 443, but ngx_tpl There is a piece of code in it that is "set $var_x_forwarded_port $server_port;", which means that the port from http to https is always the same. I don't think this change is very reasonable?
There was a problem hiding this comment.
Oh, seems I got what you mean. The server port 80 and then enable http_to_https, it'll always redirect to https://host:80 then get 400 bad request. cc @tokers @spacewander @tzssangglass
We need to take more consideration about #6686 (comment)
There was a problem hiding this comment.
Can we set a default value for this case?
If there is no X-Forwarded-Port in clinet reuqest headers, then the redirect plugin use 443 as the default https port?
There was a problem hiding this comment.
There was a problem hiding this comment.
It has default as the server_port
I mean in the redirect plugin, if someone enable http_to_https and the client request doesn't pass X-Forwarded-Port, use 443 as the default port in Location and don't care about the server_port variable.
There was a problem hiding this comment.
In my opinion, it is definitely impossible to know the listening port of https for this domain name if it is not configured from http to https, so it can be considered that the port can be configured, but the default is 443?
There was a problem hiding this comment.
As the conversation before #6686 (comment)
The original implement with an extra attribute ret_port, but no acceptable.
There was a problem hiding this comment.
Maybe we can read the correct port from config.yaml?
There was a problem hiding this comment.
把这个set $var_x_forwarded_port $server_port; 改成set $var_x_forwarded_port 443;
…pache#6686) Signed-off-by: kwanhur <[email protected]> Co-authored-by: 罗泽轩 <[email protected]>
…6686) Signed-off-by: kwanhur <[email protected]> Co-authored-by: 罗泽轩 <[email protected]>
Description
Support set redirect server port and retrieve it from header
x-forwarded-port, instead of only the well-known port443.When enable APISIX default https server, its port
9443,x-forwarded-portdefault value$server_portequals to9443, redirect to9443could meet the expectation.So support to fetch the redirect server port on specified
x-forwarded-port, it only works on enablehttp_to_httpstotrue.x-forwarded-portshould be number and range 1 to 65535.Fixed example
Test Plugincode demo.Fixes #4400
Checklist