$base_root problem

Question

In /core/lib/Drupal/Core/DrupalKernal.php the $base_root shows incorrect value:

Line 1113 protected function initializeRequestGlobals(Request $request) { global $base_url; // Set and derived from $base_url by this function. global $base_path, $base_root; global $base_secure_url, $base_insecure_url;

// Create base URL.
$base_root = $request->getSchemeAndHttpHost();

The value the $base_root is showing is the machine name, not the requested url. Specifically, the $base_root value is like: https://machinename.windows.domain.com instead of the request url like: https://ourcompany.com

I've searched the database, exported configs, and all files in the installation for the "machinename", but the only place it exists is on the windows server as "my computer" name.

Our environment is set up with an AWS loadbalancer, AWS cert on loadbalancer, that relays traffic to the windows EC2 server.

Running very recent Apache, PHP and Drupal 8.7.14. Running updated modules using composer. I don't think this is a bug.

The problems this causes is that when there is a redirect url, or self reference, such as in the webform or workflow module, you get an error because the machinename url is not accessible externally.

I wrote code to hack DrupalKernel.php that changes the $base_root using str_replace(). Also did this to RedirectResponseSubscriber.php, which FIXES my problem. But, this is the worst kind of hack programming.

Is there a way to force symfony $request->getSchemeAndHttpHost() to give my proper url? Maybe a setting I missed?

I've been very reluctant to post this question because of the obvious criticism it can draw. I've seen a lot of "working as intended" responses around $base_url issues which don't help my case.

Answer 1

Check the "Reverse Proxy Configuration" in settings.php:

/**
 * Reverse Proxy Configuration:
 *
 * Reverse proxy servers are often used to enhance the performance
 * of heavily visited sites and may also provide other site caching,
 * security, or encryption benefits. In an environment where Drupal
 * is behind a reverse proxy, the real IP address of the client should
 * be determined such that the correct client IP address is available
 * to Drupal's logging, statistics, and access management systems. In
 * the most simple scenario, the proxy server will add an
 * X-Forwarded-For header to the request that contains the client IP
 * address. However, HTTP headers are vulnerable to spoofing, where a
 * malicious client could bypass restrictions by setting the
 * X-Forwarded-For header directly. Therefore, Drupal's proxy
 * configuration requires the IP addresses of all remote proxies to be
 * specified in $settings['reverse_proxy_addresses'] to work correctly.
 *
 * Enable this setting to get Drupal to determine the client IP from the
 * X-Forwarded-For header. If you are unsure about this setting, do not have a
 * reverse proxy, or Drupal operates in a shared hosting environment, this
 * setting should remain commented out.
 *
 * In order for this setting to be used you must specify every possible
 * reverse proxy IP address in $settings['reverse_proxy_addresses'].
 * If a complete list of reverse proxies is not available in your
 * environment (for example, if you use a CDN) you may set the
 * $_SERVER['REMOTE_ADDR'] variable directly in settings.php.
 * Be aware, however, that it is likely that this would allow IP
 * address spoofing unless more advanced precautions are taken.
 */
# $settings['reverse_proxy'] = TRUE;

/**
 * Specify every reverse proxy IP address in your environment.
 * This setting is required if $settings['reverse_proxy'] is TRUE.
 */
# $settings['reverse_proxy_addresses'] = ['a.b.c.d', ...];

/**
 * Reverse proxy trusted headers.
 *
 * Sets which headers to trust from your reverse proxy.
 *
 * Common values are:
 * - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL
 * - \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED
 *
 * Note the default value of
 * @code
 * \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED
 * @endcode
 * is not secure by default. The value should be set to only the specific
 * headers the reverse proxy uses. For example:
 * @code
 * \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL
 * @endcode
 * This would trust the following headers:
 * - X_FORWARDED_FOR
 * - X_FORWARDED_HOST
 * - X_FORWARDED_PROTO
 * - X_FORWARDED_PORT
 *
 * @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL
 * @see \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED
 * @see \Symfony\Component\HttpFoundation\Request::setTrustedProxies
 */
# $settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;

There are more infos in the symfony documentation https://symfony.com/doc/current/deployment/proxies.html

Debugging

For debugging add a line to index.php and check the headers the CDN sending:

index.php:

<?php

/**
 * @file
 * The PHP page that serves all page requests on a Drupal installation.
 *
 * All Drupal code is released under the GNU General Public License.
 * See COPYRIGHT.txt and LICENSE.txt files in the "core" directory.
 */

use Drupal\Core\DrupalKernel;
use Symfony\Component\HttpFoundation\Request;

// remove after debugging    
var_dump($_SERVER);