fedora-infrastructure

#12997 Wrong redirects on elections.fedoraproject.org
Closed: Migrated to Fedora Forge by ryanlerch. Opened by adamwill.

Closed: Migrated to Fedora Forge
Reopen Issue

When logging in or out of elections.fedoraproject.org , you get redirected to https://elections.fedoraproject.org,elections.fedoraproject.org/, which is obviously wrong. It's the same on staging.

I've been poking into this and it's quite weird. One thing I noticed is that if you log out and go to https://elections.stg.fedoraproject.org/vote/32 , you get redirected to https://elections.stg.fedoraproject.org/login?next=https://elections.stg.fedoraproject.org,elections.stg.fedoraproject.org/vote/32. This redirect is, I'm pretty sure, produced by the login_required decorator, and all that does is:

        if not is_authenticated():
            return flask.redirect(
                flask.url_for("oidc_auth.login", next=flask.request.url)
            )

so the wrong next parameter in the URL is coming from flask.request.url. I've no idea how flask.request.url is coming up wrong, but it seems like it's as likely to be a deployment issue as it is a bug in the elections code, so I'm filing it here.

I'll keep poking at it for a bit, but I'm rather baffled right now, can't see any reason it would be like this.

Initially reported by @stefw , thanks.

@kevin , who is definitely enjoying his PTO, immediately knew (of course) what this was - it's openshift header forwarding behavior. Setting the haproxy.router.openshift.io/set-forwarded-headers annotation to replace (instead of the default append) seems to fix this.

If that's all there was to it, though, you'd think more stuff would be broken - using flask.request.url or similar is hardly unusual. I do wonder if elections' built-in reverse proxy thing is somehow related here. The openshift doc does specifically mention the "X-Forwarded-For" header, and the elections reverse proxy thingy seems to specifically care about that header, so it kinda adds up. I wonder if this might fix it:

diff --git a/fedora_elections/proxy.py b/fedora_elections/proxy.py
index 8839a58..e4f7bd2 100644
--- a/fedora_elections/proxy.py
+++ b/fedora_elections/proxy.py
@@ -58,7 +58,7 @@ class ReverseProxied(object):
         server = environ.get("HTTP_X_FORWARDED_HOST", "")
         if server:
-            environ["HTTP_HOST"] = server
+            environ["HTTP_HOST"] = server.split(",")[-1]
         scheme = environ.get("HTTP_X_SCHEME", "")
         if scheme:

or maybe server.split(",")[0], not sure if it's better to take the first value or the last.

Hmm, or maybe...it looks like the ReverseProxied thing in elections is basically trying to do the same as werkzeug X-Forwarded-For Proxy Fix, which is documented by flask upstream. Maybe we should switch elections to use that, with appropriate configuration?
Edited by adamwill

Filed https://pagure.io/elections/issue/106 to propose replacing ReverseProxied.

From what I can remember, this looks a bit like a problem we had in fedocal that got fixed by...

https://github.com/fedora-infra/fedocal/commit/3e00d4a425efcce6b32c6969b5aa8fc5f7d0315f

...not sure if that helps you.

Metadata Update from @james:
- Issue tagged with: medium-gain, medium-trouble

Yeah, that's pretty much exactly what I was suggesting. The tricky points to me are just:

  • How did you decide on the args x_proto=1, x_host=1 as the correct ones?
  • Do we make the invocation configurable so we can accommodate other deployments and easily adjust it if our own reverse proxying setup changes?

@abompard Ping on the above questions wrt using werkzeug.middleware.proxy_fix

Yeah we should switch to Werkzeug's implementation instead of our own (manually copied blob from one project to another).

The argument values we set depend on what we know our proxy will set in the headers. I think it sets X-Forwarded-Host so x_host=1 seems correct.

Here's the reference docs.

Yeah, I read the doc, but I didn't know which headers the proxy sets or how many levels of proxying to consider.

Metadata Update from @phsmoura:
- Issue priority set to: Waiting on Assignee (was: Needs Review)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/infra/tickets/issues/12997

Please continue any further discussion there.

Metadata Update from @ryanlerch:
- Issue close_status updated to: Migrated to Fedora Forge
- Issue status updated to: Closed (was: Open)
Metadata
None

medium-gain medium-trouble

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.