3

Its my first post in Server Fault, so I'm sorry for any faux pas :)

Problem: When I try to access "http://dummy_server/wp-admin" that is behind an apache acting as a WAF, it gets stuck in an infinite redirect loop.

The full configuration of the HAProxy and the WAF can be found here https://www.haproxy.com/blog/scalable-waf-protection-with-haproxy-and-apache-with-modsecurity/

For what I could investigate, if I access the dummy_server while turning off the apache VH (i.e. only using the HA proxy) when I do a GET to dummy_server/wp-admin, the server responds with

HTTP/1.1 302 Found
Date: Wed, 20 Feb 2019 19:00:49 GMT
Location: https://dummy_server/wp-login.php?redirect_to=.....

Then the browser redirects to dummy_server/wp-login and waits for user credentials.

Nevertheless, if I do a GET to dummy_server with the WAF activated, the Location header changes to

Location: https://dummy_server/wp-admin

and the procceds to get stuck in a redirect loop.

If I turn of the WAF configuration (I'm using modsecurity) so that the apache only acts as a reverse proxy, but the problem persists.

Here is the VM configuration:

<VirtualHost *:90>
       <IfModule mod_security2.c>
                Include /etc/apache2/owasp-modsecurity-crs/crs-setup.conf
                SecRuleEngine On
                SecRequestBodyAccess On
                SecResponseBodyAccess On
        </IfModule>
        ProxyPreserveHost On
        ProxyRequests Off
        ProxyVia Off
        ProxyPass / http://192.168.57.22:81/
        ProxyPassReverse / http://192.168.57.22:81/
</VirtualHost>

I've been searching in the site, but I haven'f found anything that helps me in my current predicament. Any ideas?

Thanks!

4
  • That looks like the configuration of your Apache reverse proxy. We need to look at the configuration of your origin server. Feb 21, 2019 at 15:18
  • Indeed, that is the apache reverse proxy conf, I thought the problem related with it. With origin server you mean the HA configuration? Feb 21, 2019 at 15:24
  • 1
    No, I mean the origin server, which is the actual web server at the end of your long chain. Feb 21, 2019 at 16:16
  • Sorry for the tardiness, It took me some time to get the config, but it was as Tero Kilkanen said, the problem was with the https Feb 27, 2019 at 18:22

2 Answers 2

9

The problem here is that your Internet-facing web server is using https, but the communication between that server and Apache2 is http.

Then, Wordpress sees that the incoming connection is coming in with http protocol, but the site URL has been defined to be https. That is why Wordpress sends the redirect to the user.

I have fixed this issue by adding the following line to wp-config.php.

$_SERVER['HTTPS'] = 'on';

I don't know if this is the preferred way of handling this issue, but it works for me.

You also need to have proper Host headers sent to to the proxied server too.

2
  • 1
    Thank you! that also worked for me, but as $_SERVER['HTTPS'] = 'on'; because on is not defined in my end Jul 23, 2019 at 6:54
  • That is a very good observation, being quoted as the string is the correct way, I updated the answer. Thanks for the info! Jul 23, 2019 at 19:01
0

In your haproxy.cfg in frontend section add:

http-request set-header X-Forwarded-Proto https if { ssl_fc }

WordPress reads this header and sets $_SERVER['HTTPS'] to 'on' when it is present and behaves correctly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .