#27961: HTTP_X_FORWARDED_PROTO is bypassed
-------------------------------------+-------------------------------------
Reporter: cryptogun | Owner: nobody
Type: Bug | Status: new
Component: HTTP handling | Version: 1.10
Severity: Normal | Resolution:
Keywords: redirect HTTPS X | Triage Stage:
-Forwarded-Proto | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Old description:
> I'm using nginx + gunicorn and display pages via HTTPS:
> 1. Both default settings:
> Nginx setting: `proxy_set_header X-Forwarded-Proto $scheme;`
> Django setting: `HTTP_X_FORWARDED_PROTO=None`
> Result: ''No redirect.'' I'm not getting a ''ERR_TOO_MANY_REDIRECTS''
> complain from Chrome.
>
> 2. Use default setting in nginx; use a wrong setting in Django, i.e. the
> 'httpsssss' part:
> `proxy_set_header X-Forwarded-Proto $scheme;`
> `HTTP_X_FORWARDED_PROTO='httpssssssss'`
> ''No redirect.''
>
> 3. Use default setting in nginx; use a wrong setting in Django:
> `proxy_set_header X-Forwarded-Proto $scheme;`
> `HTTP_X_FORWARDED_PROTASDF='httpssssssss'`
> ''No redirect.''
>
> 4. Use custom HTTPS indicator in both nginx and Django:
> proxy_set_header X-Forwarded-Protooo $scheme;
> `HTTP_X_FORWARDED_PROTOOO='https'`
> ''No redirect.'' This is the expected behavior.
>
> 5. Use custom HTTPS indicator in both nginx and Django, and testing for a
> unsafe protocol ( != 'https'):
> proxy_set_header X-Forwarded-Protooo $scheme;
> `HTTP_X_FORWARDED_PROTOOO='httpsssss'`
> Chrome complains ''ERR_TOO_MANY_REDIRECTS''. This is the expected
> behavior.
>
> 6. A fix testing by myself:
> Add an else clause under [these
> lines](https://github.com/django/django/blob/master/django/http/request.py#L196-L197).
>
> {{{
> else:
> return 'http'
> }}}
>
> And set:
> `proxy_set_header X-Forwarded-Proto $scheme;`
> `HTTP_X_FORWARDED_PROTO='httpssssssss'`
> Chrome would report the expected ''ERR_TOO_MANY_REDIRECTS''.
>
> Did someone forget to add the else clause, or there are 3 'http' 'ftp'
> and 'ftps' scheme left?
> If a site use 5. An attacker may set request `X-Forwarded-Proto` header
> to bypass the HTTPS check and result in 1,2,3.
New description:
I'm using nginx + gunicorn and display pages via HTTPS:
1. Both default settings:
Nginx setting: `proxy_set_header X-Forwarded-Proto $scheme;`
Django setting: ~~`HTTP_X_FORWARDED_PROTO=None`~~ `SECURE_PROXY_SSL_HEADER
= None`
Result: ''No redirect.'' I'm not getting a ''ERR_TOO_MANY_REDIRECTS''
complain from Chrome.
2. Use default setting in nginx; use a wrong setting in Django, i.e. the
'httpsssss' part:
`proxy_set_header X-Forwarded-Proto $scheme;`
~~`HTTP_X_FORWARDED_PROTO='httpssssssss'`~~ SECURE_PROXY_SSL_HEADER =
('HTTP_X_FORWARDED_PROTO', 'httpssssssss')
''No redirect.''
3. Use default setting in nginx; use a wrong setting in Django:
`proxy_set_header X-Forwarded-Proto $scheme;`
~~`HTTP_X_FORWARDED_PROTASDF='httpssssssss'`~~ SECURE_PROXY_SSL_HEADER =
('HTTP_X_FORWARDED_PROTASDF', 'httpssssssss')
''No redirect.''
4. Use custom HTTPS indicator in both nginx and Django:
proxy_set_header X-Forwarded-Protooo $scheme;
~~`HTTP_X_FORWARDED_PROTOOO='https'`~~ SECURE_PROXY_SSL_HEADER =
('HTTP_X_FORWARDED_PROTOOO', 'https')
''No redirect.'' This is the expected behavior.
5. Use custom HTTPS indicator in both nginx and Django, and testing for a
unsafe protocol ( != 'https'):
proxy_set_header X-Forwarded-Protooo $scheme;
~~`HTTP_X_FORWARDED_PROTOOO='httpsssss'`~~ SECURE_PROXY_SSL_HEADER =
('HTTP_X_FORWARDED_PROTOOO', 'httpsssss')
Chrome complains ''ERR_TOO_MANY_REDIRECTS''. This is the expected
behavior.
6. A fix testing by myself:
Add an else clause under [these
lines](https://github.com/django/django/blob/master/django/http/request.py#L196-L197).
{{{
else:
return 'http'
}}}
And set:
`proxy_set_header X-Forwarded-Proto $scheme;`
~~`HTTP_X_FORWARDED_PROTO='httpssssssss'`~~ SECURE_PROXY_SSL_HEADER =
('HTTP_X_FORWARDED_PROTO', 'httpssssssss')
Chrome would report the expected ''ERR_TOO_MANY_REDIRECTS''.
Did someone forget to add the else clause, or there are 3 'http' 'ftp' and
'ftps' scheme left?
If a site use 5. An attacker may set request `X-Forwarded-Proto` header to
bypass the HTTPS check and result in 1,2,3.
--
Comment (by cryptogun):
Replying to [comment:4 Tim Graham]:
> So case 1 is the bug case and in your settings you have
`SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', None)`? I can't see
from the documentation what a `None` value there is supposed to do.
Sorry, I forgot that it is SECURE_PROXY_SSL_HEADER setting. Re-updated my
main ticket.
There're 2 bug cases:
- In case 1, with no Django complain, user don't know whether his/her
setting is correct and whether the HTTPS setup correctly.
- I case 4, using a custom header by admin, a MITM may happen by:
user -- HTTP -- MITM(retrive password, set header:
`HTTP_X_FORWARDED_PROTO: https`) -- nginx(header: `HTTP_X_FORWARDED_PROTO:
https`, set header: `HTTP_X_FORWARDED_PROOO: http`) -- gunicorn(Pass, no
user redirect because `HTTP_X_FORWARDED_PROTO == https`) --
Django(`is_secure() == True` because there's no `else clause`).
--
Ticket URL: <https://code.djangoproject.com/ticket/27961#comment:5>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.ab8cd9d9e3a78746030845389f2c97ee%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
