#27961: HTTP_X_FORWARDED_PROTO is bypassed
-------------------------------------+-------------------------------------
Reporter: cryptogun | Owner: nobody
Type: Bug | Status: new
Component: | Version: 1.10
contrib.redirects | Keywords: redirect HTTPS X
Severity: Normal | -Forwarded-Proto
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
nginx + gunicorn:
1.
`proxy_set_header X-Forwarded-Proto $scheme;`
`HTTP_X_FORWARDED_PROTO=None`
''No redirect.''
2.
`proxy_set_header X-Forwarded-Proto $scheme;`
`HTTP_X_FORWARDED_PROTO='httpssssssss'`
''No redirect.''
3.
`proxy_set_header X-Forwarded-Proto $scheme;`
`HTTP_X_FORWARDED_PROTASDF='httpssssssss'`
''No redirect.''
4.
proxy_set_header X-Forwarded-Protooo $scheme;
`HTTP_X_FORWARDED_PROTOOO='https'`
''No redirect.''
5.
proxy_set_header X-Forwarded-Protooo $scheme;
`HTTP_X_FORWARDED_PROTOOO=None`
''ERR_TOO_MANY_REDIRECTS''
6.
Add an else clause under [these
lines](https://github.com/django/django/blob/master/django/http/request.py#L196-L197).
{{{
else:
return 'http'
}}}
And set:
`proxy_set_header X-Forwarded-Proto $scheme;`
`HTTP_X_FORWARDED_PROTO='httpssssssss'`
Chrome would report the expected ''ERR_TOO_MANY_REDIRECTS''
Did someone forget to add the else clause, or there are 3 'http' 'ftp' and
'ftps' scheme left?
If a site use 5. An attacker may set request `X-Forwarded-Proto` header to
bypass the HTTPS check and result in 1,2,3.
--
Ticket URL: <https://code.djangoproject.com/ticket/27961>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/052.54bc04c4f21a28c608807fe7db0776f6%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
