Bug #92187

HTTP/HTTPS not correctly determined behind reverseProxy

Added by Thorben Nissen over 1 year ago. Updated 6 months ago.

Status:
Under Review
Priority:
Should have
Assignee:
-
Category:
System/Bootstrap/Configuration
Target version:
-
Start date:
2020-09-03
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
9
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

When using TYPO3 behind a reverse proxy with SSL termination and setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['reverseProxySSL'] to '*' or any ip address, TYPO3 assumes, that the request is using HTTPS even though the proxy might have received it as HTTP. It should honor the X-Forwarded-Proto header, if set.

This effects all active versions (9, 10 and master).


Related issues

Related to TYPO3 Core - Bug #29693: Respect HTTP_X_FORWARDED_PROTO in SSL checkRejectedMichael Stucki2011-09-12

Actions
#1

Updated by Gerrit Code Review over 1 year ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65550

#2

Updated by Christian Kuhn over 1 year ago

  • Related to Bug #29693: Respect HTTP_X_FORWARDED_PROTO in SSL check added
#3

Updated by Anja Leichsenring over 1 year ago

  • Status changed from Under Review to Rejected

as stated in the patch, this fix will not be accepted because it opens a security vulnerability.

#4

Updated by Christian Kuhn over 1 year ago

  • Status changed from Rejected to New
#5

Updated by Gerrit Code Review over 1 year ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65573

#6

Updated by Gerrit Code Review over 1 year ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65573

#7

Updated by Gerrit Code Review over 1 year ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65573

#8

Updated by Gerrit Code Review 8 months ago

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65573

#9

Updated by Gerrit Code Review 6 months ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65573

#10

Updated by Gerrit Code Review 6 months ago

Patch set 6 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/65573

Also available in: Atom PDF