Skip to content

Fix wrong url when behind proxy#647

Open
lezab wants to merge 2 commits into
SAML-Toolkits:4.x-devfrom
lezab:fix_wrong_url_when_behind_proxy
Open

Fix wrong url when behind proxy#647
lezab wants to merge 2 commits into
SAML-Toolkits:4.x-devfrom
lezab:fix_wrong_url_when_behind_proxy

Conversation

@lezab
Copy link
Copy Markdown

@lezab lezab commented May 22, 2026

First of all, I wanted to apologize because it seems I didn't follow the proper procedure for the pull request (submitting it directly to the dev branch).
So I closed the other PR and reopened this one. That also gave me a chance to fix a few minor issues along the way. I also made two separate commits to separate the proxy usage as a parameter from the problem relative to local url path.

So I answer here to your comments in the other PR :

@lezab, when you are behind a proxy, you already can invoke:
OneLogin\Saml2\Utils::setProxyVars(true);
that will do the same than the setting 'useProxy' => true that you added
I decided to not control it on a settings because if your service is under a proxy, gonna be under a proxy all the time, so you simply call the method while loading the settings.

The issue here is that when you develop an application that you want to distribute, you don’t know whether the user will run it behind a proxy or not. It seems to me that having this as a parameter could be usefull.

If you want to override the baseUrl or path, you have the setBaseURL and setBaseURLPath
I believe that using those methods properly, you get the same result as using the new setLocalURLPath method that you created.
Maybe you can add tests of that setLocalURLPath and I can commit how do the same with the methods currently available.

I also red the answers you did to #629.
The point is that, in some cases, this isn't enough. Setting basURL and/or baseURLPath doesn't make a difference because the buildWithBaseUrlPath function doesn't allow you to remove the installation directory from the beginning of $_SERVER['SCRIPT_NAME'] or $_SERVER['REQUEST_URI'].

Example:
The application is installed on : https://server.domain/my/install/folder/application/ (typically on linux/apache : /var/www/html/my/install/folder/application/ with root on /var/www/html/)
But accessed via reverse proxy by : https://application.domain/ (the reverse proxy is an another server with the virtual host “application” configured to act as rp on the url above)
The library says : “The response was received at https://application.domain/my/install/folder/application/login_sso instead of https://application.domain/login_sso” because $currentURL (in Response::isValid()) is wrong

I wrote a test as you suggested. I hope I made myself clearer this time.

Thaks for your attention.
Best regards

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant