WP and squid reverse proxy

  • I have a unique situation. I run ipchains on ubuntu which is my firewall which then passes the http or https traffic to squid which then sends the traffic based on rules to the appropriate and separate web servers. WHat happens is squid has all of the certs for every https site thanks to letsencrypy. Every site is vhosted using apache.

    So here we have squid detecting if a request comes in via port 80, it send a 301 redirect to the browser telling it to use port 443/HTTPS. Since I have a trusted network, squid translates the incoming https to HTTP and then send it to the webserver where WP resides. To fix the “mixed content” issue, I tell the browser to use https for all links received by adding the header “upgrade-insecure-requests” That took care of all the mixed content notices. Believe it or not, all is well except when logging out. When a user logs out, he is presented with a “are you sure” message with the title of “WordPress Error” and logout never occurs. WHen looking at the URL being passed to logout, it includes the correct URL plus the redirect header sent by squid.

    To fix this issue, I resorted to adding another url rule in squid that says if URL = https:blah blah logout” then allow http which takes care of the logout issue.

    You might ask why. To prevent bad URL requests from reaching the web server, squid provides a disconnect between the browser and the apache(http) server. Since squid can do proper translation, http and https can both be used to conact my main site. Having said that, anything that gets clicked on gets redirected to https.

    I didn’t want to dive into the code of WP to fix the logout issue. Too many red herrings. Now is someone is really interested in seeing this in action or fixing this issue, I can provide a URL for you to play with. I have a couple of WP sites set up for testing. BTW, it is NOT the nonce number that is messed up.

    conceptually the path looks like this

    browser(https)->internet -> firewall->(https)squid proxy->(http)->apache2 server ->wordpress

    So, all in all things aren’t bad. They could be just a little cleaner.

    I didn’t have to change one thing in the wordpress or woocommerce. I did disable all caching plugins just to be sure. I will be testing them later to be sure they don’t cause problems. If anyone wants the result of any plugin tests, I will happy to post them.

    Richard

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter aetool

    (@aetool)

    As a followup, here is the URL that gets sent back after clicking logout.

    https://ae-tool.com/wp-login.php?action=logout&redirect_to=https%3A%2F%2Fae-tool.com%2Findex.php%2Fmy-account%2F&_wpnonce=924e6c8f31

    Thread Starter aetool

    (@aetool)

    The fix is to edit the function is_ssl in wp-includes/load.php
    —————————————————

    978 } elseif ( isset($_SERVER[‘SERVER_PORT’] ) && ( ‘443’ == $_SERVER[‘SERVER_PORT’] ) ) {
    979 return true;
    980 }
    981 /* RJA FORCE SSL */
    982 /* return false; */
    983 return true;

    ——————————————————–

    Once that is applied, then all urls have “https//…..”

    I have not found anything that does not work.

    • This reply was modified 7 years, 2 months ago by bdbrown. Reason: Fixed code
    • This reply was modified 7 years, 2 months ago by bdbrown.
    • This reply was modified 7 years, 2 months ago by bdbrown.
    Thread Starter aetool

    (@aetool)

    backupwordpress does not work. That seems to be the only thing that does not work.

    • This reply was modified 7 years, 2 months ago by aetool.

    Hi! I’m trying to achieve something similar. I’ve just installed WordPress on CentOS 7. I works fine internally, but form internet I have a pfSense router with Squid reverse proxy. It works just fine with HTTPS content, but I can’t make it work with WordPress, the page loads corrupted.

    Any ideas?

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘WP and squid reverse proxy’ is closed to new replies.