使用flask-googlelogin与gunicorn和nginx导致400 Bad Request

Question

Update: It seems to work when I configure my nginx server to allow http and set the Redirect URI for Google OAuth to use http (not https). I'd really prefer to use HTTPS, though, so any thoughts are appreciated.

---

I'm trying to use the flask-googlelogin plugin to authorize users to my web-app. Things are working fine when running the debug server and connecting to it directly, but when I run my app behind nginx acting as a reverse proxy (either to the debug server or to my app running inside gunicorn), I get 400 Bad Request responses on my login callback that say "The browser (or proxy) sent a request that this server could not understand".

The gunicorn logs (when running with gunicorn) don't show anything interesting. The nginx logs (on info level) show the 400 being returned:

» tail -f /var/log/nginx/*

==> /var/log/nginx/access.log <==
76.164.174.115 - - [21/May/2014:13:07:46 -0500] "GET /login HTTP/1.1" 200 1368 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36"
76.164.174.115 - - [21/May/2014:13:07:49 -0500] "GET /oauth2callback?state=[redacted]&code=[redacted] HTTP/1.1" 400 192 "https://redacted.com/login" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36"

This 400 seems to be coming from flask. If I run my app from the console (not inside gunicorn) I see the following:

» python automation.py
 * Running on http://127.0.0.1:8000/
 * Restarting with reloader
127.0.0.1 - - [21/May/2014 12:12:17] "GET /login HTTP/1.0" 200 -
127.0.0.1 - - [21/May/2014 12:12:20] "GET /oauth2callback?state=[redacted]&code=[redacted] HTTP/1.0" 400 -

So the GET is being proxied to the application, but flask doesn't like it for some reason. Here are the relevant parts of my application:

from flask import Flask, request, render_template, redirect, url_for, flash, session
from flask_login import current_user, login_required, login_user, logout_user, UserMixin, LoginManager
from flask_googlelogin import GoogleLogin
from werkzeug.contrib.fixers import ProxyFix
import json

app = Flask(__name__)
app.wsgi_app = ProxyFix(app.wsgi_app)
app.secret_key = "redacted"
app.config.update(
    GOOGLE_LOGIN_CLIENT_ID='redacted',
    GOOGLE_LOGIN_CLIENT_SECRET='redacted',
    GOOGLE_LOGIN_REDIRECT_URI='https://redacted.com/oauth2callback',
)

login_manager = LoginManager()
login_manager.init_app(app)
login_manager.login_view = "login"
login_manager.login_message = u"Please log in to access this page."
login_manager.login_message_category = u"danger"
googlelogin = GoogleLogin(app, login_manager)

class User(UserMixin):
    def __init__(self, userinfo):
        self.name = userinfo['name']
        self.id = userinfo['id']
        self.picture = userinfo.get('picture')

users = {
    "redacted1" : None,
    "redacted2" : None,
}

@googlelogin.user_loader
@login_manager.user_loader
def load_user(userid):
    return users.get(userid)

@app.route("/login", methods=['GET', 'POST'])
def login():
    return render_template('login.html', login_url=googlelogin.login_url())

@app.route('/oauth2callback')
@googlelogin.oauth2callback
def oauth2callback(token, userinfo, **params):
    if userinfo['id'] in users:
        user = users[userinfo['id']] = User(userinfo)
        login_user(user)
        session['token'] = json.dumps(token)
        flash("Logged in", "success")
        return redirect(params.get('next', url_for('automation')))
    else:
        flash("That google user is not authorized.", "danger")
        return redirect(url_for('login'))

@app.route("/automation", methods=['GET'])
@login_required
def automation():
    return render_template('automation.html')

@app.route("/logoff")
@login_required
def logoff():
    logout_user()
    session.clear()
    flash("logged out", "info")
    return redirect(url_for('login'))

if __name__ == "__main__":
    app.config.update( GOOGLE_LOGIN_REDIRECT_URI='http://localhost:5000/oauth2callback' )
    app.run(debug=True)

The usual reason for 400 Bad Request errors out of Flask seems to be an uncaught exception in a view function, but I've tried reducing my entire oauth2callback to nothing but a print and a pass and still fails and I don't see the print output.

Here is the relevant part of my nginx config:

server {
    listen 443;
    server_name redacted.com www.redacted.com;

    root /usr/share/nginx/www;
    index index.html index.htm;

    ssl on;
    ssl_certificate /etc/ssl/certs/ssl-bundle.pem;
    ssl_certificate_key /etc/ssl/private/myserver.key;

    ssl_session_timeout 5m;

    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
    ssl_prefer_server_ciphers on;

    location / {
            try_files $uri $uri/ @proxy_to_app;
    }

    location @proxy_to_app {
            proxy_pass http://127.0.0.1:8000;
            proxy_redirect off;

            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Thanks in advance.

Answer 1

I had the same problem using uwsgi.

I was able to fix it by adding the following line to my /etc/nginx/uwsgi_params .

uwsgi_param  UWSGI_SCHEME       $server_protocol;

I also added to my app.config

app.config['GOOGLE_LOGIN_REDIRECT_SCHEME'] = "https"

Best of luck.