1

I have a Nginx setup for my Thin server running a Ruby on Rails project. Nginx is currently the endpoint for my SSL.

I recently had some issues with attacks on my webserver, so I decided to add CloudFlare. It currently uses "Strict SSL" from cloudflare (ssl in client-CF link and CF-webserver link). This works now when browsing my website, but when I am using Oauth to facebook, G+ etc. The redirect link shows up as: https://example.com:80/destination/url(note the :80). This does not happen when I do not use CloudFlare.

What can I do to fix this? Is it an issue in CloudFlare, or Nginx? I found this post, but I was not able to reverse engineer it to nginx.

My current nginx-setup:

server {
      listen      80 default;
      server_name .example.com;
      ## redirect http to https ##
      return 301 https://example.com$request_uri;
}
server {
  listen      443 ssl;
  server_name .example.com;

  client_max_body_size 20M;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;


  ssl_certificate     /home/my_user/.ssl/example.crt;
  ssl_certificate_key /home/my_user/.ssl/example.key;

  access_log /var/www/example_server/log/access.log;
  error_log  /var/www/example_server/log/error.log;
  root     /var/www/example_server;
  index    index.html;

  if ($host != 'example.com' ) {
    return 301 https://example.com$request_uri;
  }

  location / {
    proxy_set_header  X-Real-IP  $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;
    proxy_set_header  X_FORWARDED_PROTO $scheme;
    proxy_redirect  off;
    try_files /system/maintenance.html $uri $uri/index.html $uri.html @ruby;
  }

  location @ruby {
    proxy_pass http://example.com;
  }
}

In my nginx.conf:

#default stuff

http{
set_real_ip_from *IP address for cloudflare*;
#....

port_in_redirect off;

#more default stuff

For reference, the current request path: Client Request -SSL-> CloudFlare -SSL-> Nginx -non-SSL-> Thin -non-ssl-> Nginx -SSL-> CloudFlare -SSL-> Client Response

2
  • What do you get when you visit your site directly, bypassing CloudFlare? Oct 3, 2014 at 17:34
  • Then everything works fine, but then again, no proxy is used. I am unsure if it is my proxy settings in nginx that is causing this, or somehow something in cloudflare.
    – Automatico
    Oct 3, 2014 at 19:36

2 Answers 2

1

It appears that there is an issue in the Omniauth gem which is causing this issue. Why it is only an issue when I use CloudFlare, and not an issue when it is turned off, beats me.

Anyway, here is the issue on github:

https://github.com/intridea/omniauth/issues/101

My solution:

In the rails app, create a new initializer (config/initializers/omniauth_fix.rb) with this content:

if Rails.env.production?
  module OmniAuth
    module Strategy
      def full_host
        uri = URI.parse(request.url)
        uri.path = ''
        uri.query = nil
        uri.port = (uri.scheme == 'https' ? 443 : 80)
        uri.to_s
      end
    end
  end
end

It is essentially a monkeypatch over the issue. Hopefully it will be fixed in future releases of omniauth.

0

This seems odd because we don't add any redirects, unless you specifically ask us to do so with a PageRule. I would recommend opening a support ticket with CloudFlare support so we can check it out.

3
  • I have one pagerule that is essentially "force ssl on every page". Maybe I am misunderstanding the request-path when using cloudflare.
    – Automatico
    Oct 3, 2014 at 19:38
  • Probably still best to look at this via CloudFlare support so reps can check your configuration. The behavior doesn't seem normal to me because we don't do anything that's really going to modify URLs, even with PageRules active. Oct 6, 2014 at 18:11
  • I made a support ticket, but still nothing. This is so strange. I can't figure out why this is happening.
    – Automatico
    Oct 9, 2014 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .