Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jetty setRelativeRedirectAllowed #12

Open
vkz opened this issue Oct 21, 2022 · 2 comments
Open

Jetty setRelativeRedirectAllowed #12

vkz opened this issue Oct 21, 2022 · 2 comments

Comments

@vkz
Copy link

vkz commented Oct 21, 2022

;; HACK Jetty defaults to not comply with RFC 3986 section 5 in that by default it rewrites
  ;; relative and absolute redirects to complete URL. When you terminate SSL on the load-balancer in
  ;; front of Jetty, url scheme ends up HTTP, so Jetty's response has location header set to
  ;; e.g. http://fullmeta.co.uk/hello for redirect to /hello. Since original request comes from
  ;; behind https, browser blocks such redirects. Propre way to handle this is to:
  ;;
  ;; (doto (HttpConfiguration.)
  ;;   (.setRelativeRedirectAllowed true))
  ;;
  ;; Sadly no ring jetty adapter in use allows to do that.

Problem well described:
https://stackoverflow.com/questions/25652718/do-relative-server-side-redirects-respect-the-protocol

https://www.eclipse.org/jetty/javadoc/jetty-10/org/eclipse/jetty/server/HttpConfiguration.html#setRelativeRedirectAllowed(boolean)

https://github.com/ring-clojure/ring/blob/master/ring-jetty-adapter/src/ring/adapter/jetty.clj#L68

https://github.com/sunng87/ring-jetty9-adapter/blob/master/src/ring/adapter/jetty9.clj#L127

jetty/jetty.project#6883

@vkz
Copy link
Author

vkz commented Oct 26, 2022

Simplest solution though temporary. Fork, change one line to setRelativeRedirectAllowed and pull it as git module, until I get to take it over and integrate into fullmeta web.

@vkz
Copy link
Author

vkz commented Oct 27, 2022

Turns out I have wrap-absolute-redirects middleware wrapped around my handlers and likely it was the one messing up http vs https. Try to remove and then test deploy without the temp hack - see if it fixes the issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant