使用Rails config.force_ssl在远程SSL代理后面进行无限重定向

Question

I am running a Rails 5.2 app on an Ubuntu VM provided by my organisation. It's served by Nginx (1.14.0) and Passenger (6.0.1).

SSL is provided by the organisation through a load balancer. My app is hosted on myapp1 on the internal network and the organisation provides a public-facing myapp.org.com, which provides SSL to the end user and proxies traffic via HTTP over the internal network to myapp1. I have no control over the load balancer at myapp.org.com.

The app is also served at the /project subdirectory. When I access https://myapp.org.com/ , I get a 403 from my Nginx server, as expected (for now). When I access https://myapp.org.com/projects , I get an infinite 301 redirect loop (redirecting to the same URL...).

My Nginx config looks like this:

server {
    listen 80;
    server_name myapp myapp.org.com myapp.organisation.com;
    add_header X-Forwarded-Proto https;

    root /var/www;

    location ~ ^/project(/.*|$) {
        # Tell Nginx and Passenger where your app's 'public' directory is
        alias /var/www/project-production/current/public/$1;

        # Turn on Passenger
        passenger_ruby /usr/share/rvm/gems/ruby-2.5.3@project-production/wrappers/ruby;
        passenger_base_uri /project;
        passenger_app_root /var/www/project-production/current;
        passenger_document_root /var/www/project-production/current/public;
        rails_env production;
        passenger_enabled on;
    }
}

And config/environments/production.rb contains config.force_ssl = true .

In trying to solve this, I also tried using proxy_set_header X-Forwarded-Proto https; and no X-Forwarded-Proto header at all.

If I set config.force_ssl = false , it redirects to http and the organisation's SSO refuses to serve the app.

All of the related posts I can find on SO and around the web talk about using Nginx as a proxy to a local Rails server (like Unicorn or Passenger standalone), but this problem seems to be distinct in that Nginx is serving http requests to a remote SSL-enabled proxy.

Answer 1

Your organizations's load balancer must pass X-Forwarded-Proto to your nginx instance. Your application cannot detect its being browsed by a ssl-terminated load balancer. If it doesn't work, you may need to whitelist load balancer's ip inside your application. (i don't know how, i don't code ruby)