I'm trying to run Drupal 8.0.5 on Apache 2.4 behind an Nginx reverse proxy (both on the same host). However, I'm running into problems w.r.t. trusted_host_patterns
, i.e. I'm getting The provided host name is not valid for this server.
.
In Apache, the HTTP Host
header doesn't contain target host of the original request but the reverse proxy (since I'm using mod_remoteip
). However, I have set up Nginx to pass on the Host
header value of the original request in the X-Forwarded-Host
header:
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Forwarded "for=$remote_addr;proto=$scheme";
I have also told Drupal that it's running behind a reverse proxy:
$settings['reverse_proxy'] = TRUE;
/**
* Specify every reverse proxy IP address in your environment.
* This setting is required if $settings['reverse_proxy'] is TRUE.
*/
$settings['reverse_proxy_addresses'] = ['127.0.0.1'];
/**
* Set this value if your proxy server sends the client IP in a header
* other than X-Forwarded-For.
*/
# $settings['reverse_proxy_header'] = 'X_CLUSTER_CLIENT_IP';
/**
* Set this value if your proxy server sends the client protocol in a header
* other than X-Forwarded-Proto.
*/
# $settings['reverse_proxy_proto_header'] = 'X_FORWARDED_PROTO';
/**
* Set this value if your proxy server sends the client protocol in a header
* other than X-Forwarded-Host.
*/
# $settings['reverse_proxy_host_header'] = 'X_FORWARDED_HOST';
/**
* Set this value if your proxy server sends the client protocol in a header
* other than X-Forwarded-Port.
*/
# $settings['reverse_proxy_port_header'] = 'X_FORWARDED_PORT';
/**
* Set this value if your proxy server sends the client protocol in a header
* other than Forwarded.
*/
# $settings['reverse_proxy_forwarded_header'] = 'FORWARDED';
Hence I don't understand why the hostname validation still fails. If I disable mod_remoteip
then both Host
and X-Forwarded-Host
contain the original target host, and in that case hostname validation succeeds. It seems that Drupal fails to use X-Forwarded-Host
instead of Host
.
reverse_proxy_addresses
, so my proxy should be trusted. The comments insettings.php
indicate that the default value forreverse_proxy_host_header
isX-Forwarded-Host
, which I'm setting in Nginx. (Note that my original post had a wrong version of my Nginx configuration, I've fixed that now)