XForwardedSupport https 播放！对 Heroku 失败的支持 [英] XForwardedSupport for https play! support on Heroku failing

问题描述

我正在 Heroku 上部署一个应用程序并尝试确定传入的请求是否安全 (request.secure).这最初在 heroku 上返回 false，因为 nginx 处理 SSL 工作并通过普通 http 与应用程序服务器通信.所以为了让播放读取让我们知道这是一个安全请求的标题，我添加:

I am deploying an app on Heroku and trying to determine whether the request coming in is secure (request.secure). This is initially returning false on heroku because nginx handles the SSL work and communicates over plain http to the app server. So to let play read the headers that let is know it's a secure request I add:

XForwardedSupport=127.0.0.1

XForwardedSupport=127.0.0.1

按照 play 留言板中的建议到 application.conf.但是，所有请求(图像除外)都会失败且没有错误.在它击中播放日志之前，这似乎是一些基本的事情.有人经历过吗?

To application.conf as recommended in the play message boards. However, then all requests (except for images) fail with no error. It seems to be something fundamental happening before it hits the play logs. Has anyone experienced this?

推荐答案

我认为 Play 不支持通过 XForwardedSupport 配置参数在 Heroku 上转发(代理)请求的方式.这需要设置为 Heroku 负载均衡器的地址，并且没有办法配置该预运行时.相反，您应该只查看 x-forwarded-proto 请求标头，以确定对 Heorku 负载均衡器的请求是通过 http 还是通过 https.也许是这样的:

I don't think Play supports the way that requests are forwarded (proxied) on Heroku via the XForwardedSupport configuration parameter. That would need to be set to the address of the Heroku load balancer and there isn't a way to configure that pre-runtime. Instead, you should just look at the x-forwarded-proto request header to determine if the request to the Heorku load balancer was via http or https. Maybe something like:

    Boolean secure = false;
    if (request.headers.get("x-forwarded-proto") != null) {
      secure = request.headers.get("x-forwarded-proto").values.contains("https");
    }
    System.out.println("secure = " + secure);

顺便说一句:Heroku 的 cedar 堆栈不使用 Nginx.它使用基于 Erlang 的网络服务器 MochiWeb.

BTW: Heroku's cedar stack doesn't use Nginx. It uses MochiWeb, an Erlang-based web server.

这篇关于XForwardedSupport https 播放！对 Heroku 失败的支持的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！