{"action":"created","issue":{"url":"https://api.github.com/repos/florianheinemann/express-sslify/issues/16","repository_url":"https://api.github.com/repos/florianheinemann/express-sslify","labels_url":"https://api.github.com/repos/florianheinemann/express-sslify/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/florianheinemann/express-sslify/issues/16/comments","events_url":"https://api.github.com/repos/florianheinemann/express-sslify/issues/16/events","html_url":"https://github.com/florianheinemann/express-sslify/pull/16","id":162200515,"number":16,"title":"support x-forwarded-proto header with multiple proxies","user":{"login":"rdy","id":21672,"avatar_url":"https://avatars.githubusercontent.com/u/21672?v=3","gravatar_id":"","url":"https://api.github.com/users/rdy","html_url":"https://github.com/rdy","followers_url":"https://api.github.com/users/rdy/followers","following_url":"https://api.github.com/users/rdy/following{/other_user}","gists_url":"https://api.github.com/users/rdy/gists{/gist_id}","starred_url":"https://api.github.com/users/rdy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rdy/subscriptions","organizations_url":"https://api.github.com/users/rdy/orgs","repos_url":"https://api.github.com/users/rdy/repos","events_url":"https://api.github.com/users/rdy/events{/privacy}","received_events_url":"https://api.github.com/users/rdy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-06-24T18:07:37Z","updated_at":"2016-06-27T05:44:33Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/florianheinemann/express-sslify/pulls/16","html_url":"https://github.com/florianheinemann/express-sslify/pull/16","diff_url":"https://github.com/florianheinemann/express-sslify/pull/16.diff","patch_url":"https://github.com/florianheinemann/express-sslify/pull/16.patch"},"body":"It is possible under certain conditions when multiple load balancers are in play the x-forwarded-proto header should expect that https is forwards as long as the first entry in a comma separated list for x-forwarded-proto is https.\r\n\r\nI changed the check for trusting the proto header to use a regular expression matching what other libraries are doing."},"comment":{"url":"https://api.github.com/repos/florianheinemann/express-sslify/issues/comments/228658730","html_url":"https://github.com/florianheinemann/express-sslify/pull/16#issuecomment-228658730","issue_url":"https://api.github.com/repos/florianheinemann/express-sslify/issues/16","id":228658730,"user":{"login":"rdy","id":21672,"avatar_url":"https://avatars.githubusercontent.com/u/21672?v=3","gravatar_id":"","url":"https://api.github.com/users/rdy","html_url":"https://github.com/rdy","followers_url":"https://api.github.com/users/rdy/followers","following_url":"https://api.github.com/users/rdy/following{/other_user}","gists_url":"https://api.github.com/users/rdy/gists{/gist_id}","starred_url":"https://api.github.com/users/rdy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rdy/subscriptions","organizations_url":"https://api.github.com/users/rdy/orgs","repos_url":"https://api.github.com/users/rdy/repos","events_url":"https://api.github.com/users/rdy/events{/privacy}","received_events_url":"https://api.github.com/users/rdy/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T05:44:33Z","updated_at":"2016-06-27T05:44:33Z","body":"There is no full formal specification but the draft proposal as it seems to be implemented:\r\nhttp://tools.ietf.org/html/draft-ietf-appsawg-http-forwarded-10\r\n\r\nI wasn't sure about this also at first, but I looked through other libraries and languages:\r\nhttps://github.com/aspnet/BasicMiddleware/issues/18\r\nhttps://github.com/deis/deis/issues/4997\r\n\r\nI ultimately decided to use a similar approach that these other libraries used to fix this problem. The first entry in x-forwarded-proto should match https to assume that the traffic will be unwrapped by the load balancer.\r\n\r\nI believe they use a similar approach in rack which is what this pull request emulates. It might be possible to support other offline protocols by adjusting the reggae but I didn't have a use case for that.\r\n\r\nI added some tests to ensure the original functionality stayed the same. We've tested my fork to make sure that it indeed works. I've verified that in an AWS environment with an ELB and also a secondary HA proxy layer this express middleware does the right thing with SSL. Without this change it won't work in environments with multiple load balancers in front that potentially unwrap SSL ahead of the app. This is in a cloud foundry environment FYI."}}
{"actor":{"display_login":"rdy"}}