OAuth behind CloudFront https to http proxy not working

bkolobara

I moved my forum behind AWS' CloudFront CDN. Now I'm having the problem that my OAuth (Github & Facebook) redirect url is automatically set to http, because the https connection is between the browser and CloudFront, but between CloudFront and the server there is a http connection.

I set the X-Forwarded-Proto header to https, but it looks like flarum is ignoring it.

Is there a way to force flarum to always use https in the internal url constructions?

luceos

bkolobara make sure the url in your config.php uses https too.

bkolobara

luceos It does. This was the first thing I checked.

bkolobara

I'm currently using a workaround until I find a better solution. I just force flarum into thinking it's on a https connection by adding $_SERVER['HTTPS']='on'; to config.php. E.g.

<?php

// Force https as protocol
$_SERVER['HTTPS']='on';

return array (
  'debug' => false,
  'database' =>
  array (
  ... rest of config...

But I believe it should be possible to add to the apache config a setting like SetEnvIf X_FORWARDED_PROTO https HTTPS=on. This didn't work for me though 🙁.

clarkwinkelmann

Doesn't CloudFront offer a way to have a trusted certificate between the proxy and your website ?

On Cloudflare those are called Origin Certificates and allow the full connection to be encrypted. Not sure if AWS has anything like it. It has the benefit of not changing protocol so Flarum sees HTTPS whether the proxy is used or not.

bkolobara

clarkwinkelmann There should be a way of doing this, but who has the time to set it up 🙂.