redirects to wrong port after login when jforum is running behind a reverse proxy

[Migrated From Jforum.net]

Hi,

I ran into a problem when deploying JForum in our network setup. We use a reverse proxy (squid). Every time someone logged in, the browser was redirected to a url that could not be resolved.

The problem could be boiled down to these lines of code (in UserAction.validateLogin()):

String forwaredHost = request.getHeader("X-Forwarded-Host");
if (forwaredHost == null) {
  JForumExecutionContext.setRedirect(this.request.getContextPath()
    + "/forums/list"
    + SystemGlobals.getValue(ConfigKeys.SERVLET_EXTENSION));
}
else {
  JForumExecutionContext.setRedirect(this.request.getScheme()
    + "://"
    + forwaredHost
    + this.request.getContextPath()
    + "/forums/list"
    + SystemGlobals.getValue(ConfigKeys.SERVLET_EXTENSION));
}

When I just use this code:

JForumExecutionContext.setRedirect(this.request.getContextPath()
  + "/forums/list"
  + SystemGlobals.getValue(ConfigKeys.SERVLET_EXTENSION));

I can login just fine.

The problem is that the reverse proxy sets the "X-Forwarded-Host" header to a virtual host configured on apache running on a different server (e.g. it redirects www.tst.nl and sets the header to www.tst.nl:8000). Now when the above code constructs the redirect url with this header entry, the request comes back to our squid server, which is not listening on this port, which causes the error.

On the contrary, after reading here it seems other people were getting problems with this code when behind a regular proxy server. So perhaps this code could be modified to take a reverse proxy setup into account?

Regards,
Alex
[originally posted on jforum.net by buijs]

[Migrated From Jforum.net]

Hi,

I'm having the same problem using a reverse proxy. I hadn't not identified the source of the problem, so thank you very much, Alex.

Cheers,
Jonathan
[originally posted on jforum.net by jooooooon]

[Migrated From Jforum.net]

Added to Jira:

http://www.jforum.net/jira/browse/JF-683

Rafael
[originally posted on jforum.net by Rafael Steil]

[Migrated From Jforum.net]

Ok, bug fixed. Added a new configuration key named "login.ignore.xforwardedhost"

Rafael
[originally posted on jforum.net by Rafael Steil]