1

I'm trying to run Drupal 8.0.5 on Apache 2.4 behind an Nginx reverse proxy (both on the same host). However, I'm running into problems w.r.t. trusted_host_patterns, i.e. I'm getting The provided host name is not valid for this server..

In Apache, the HTTP Host header doesn't contain target host of the original request but the reverse proxy (since I'm using mod_remoteip). However, I have set up Nginx to pass on the Host header value of the original request in the X-Forwarded-Host header:

proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host   $host;
proxy_set_header X-Forwarded-Port   $server_port;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header Forwarded          "for=$remote_addr;proto=$scheme";

I have also told Drupal that it's running behind a reverse proxy:

$settings['reverse_proxy'] = TRUE;

/**
 * Specify every reverse proxy IP address in your environment.
 * This setting is required if $settings['reverse_proxy'] is TRUE.
 */
$settings['reverse_proxy_addresses'] = ['127.0.0.1'];

/**
 * Set this value if your proxy server sends the client IP in a header
 * other than X-Forwarded-For.
 */
# $settings['reverse_proxy_header'] = 'X_CLUSTER_CLIENT_IP';

/**
 * Set this value if your proxy server sends the client protocol in a header
 * other than X-Forwarded-Proto.
 */
# $settings['reverse_proxy_proto_header'] = 'X_FORWARDED_PROTO';

/**
 * Set this value if your proxy server sends the client protocol in a header
 * other than X-Forwarded-Host.
 */
# $settings['reverse_proxy_host_header'] = 'X_FORWARDED_HOST';

/**
 * Set this value if your proxy server sends the client protocol in a header
 * other than X-Forwarded-Port.
 */
# $settings['reverse_proxy_port_header'] = 'X_FORWARDED_PORT';

/**
 * Set this value if your proxy server sends the client protocol in a header
 * other than Forwarded.
 */
# $settings['reverse_proxy_forwarded_header'] = 'FORWARDED';

Hence I don't understand why the hostname validation still fails. If I disable mod_remoteip then both Host and X-Forwarded-Host contain the original target host, and in that case hostname validation succeeds. It seems that Drupal fails to use X-Forwarded-Host instead of Host.

  • Does the doc block for this method help? – Clive May 3 '16 at 10:08
  • @Clive: Not really :) I've configured reverse_proxy_addresses, so my proxy should be trusted. The comments in settings.php indicate that the default value for reverse_proxy_host_header is X-Forwarded-Host, which I'm setting in Nginx. (Note that my original post had a wrong version of my Nginx configuration, I've fixed that now) – Florian Brucker May 3 '16 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.