fuel/core — Issue #631: SSL reverse proxying
Author: krtek4
Created: 2011-10-31 15:11:08+00:00
State: open

When trying to do SSL reverse proxying for a FuelPHP application, the method `Input::protocol()` returns 'HTTP'. Since this method is used, for example, to compute the form action url, it can lead to various problems where it isn't the right server which is contacted.

The architecture :

Internet user --> Reverse Proxy (HTTPS, NGinx in my case) --> Web Server (HTTP, Apache in my case)

The problem is FuelPHP is running on the Apache server which is called with the HTTP protocol, but the user access the website through HTTPS, thus the url used for the form action should also be HTTPS.

The common way to resolve this issue is to set the header "X-Forwarded-Proto" to HTTPS when the proxy send the query to the webserver. The application then check this value to return the right URL based on the proxy protocol. This is better explained on the following drupal bug : http://drupal.org/node/313145

I made a pull request yesterday about this issue, but WanWizard raised a valid security concert about my patch : https://github.com/fuel/core/pull/629#issuecomment-2577192

I suggest two other ways to circumvent this issue :

1° Add a config value to core to specify the protocol to use when creating URL. I know you can set the `base_url` value, but I'm talking about something which will enable to set only the protocol.

2° Since my problems is with the automatic URL for form actions, add a config value to form to generate HTTPS url when set.

The second option would also be useful for people having an HTTP website, but decides to send only form data through HTTPS.