Unable to run policy-bot behind a reverse-prxoy
KnisterPeter opened this issue · 3 comments
Even if configuration states differently (here), it's not possible to operate the policy-bot behind a reverse proxy.
This is caused by the wrong setup of the github authorization flow in this case.
The github default setup does create the redirect url (callback) at the end of the auth flow with the requests host header. This header is in case of a reverse-proxy set to the ip/host of that proxy.
Instead it should be the configured proxy host.
Can anyone confirm this behavior?
Our expectation is that reverse proxies set an appropriate Host header for the application (e.g. by using a proxy_set_header Host $host; directive in NGINX). If that's not possible, then yes, I believe the GitHub OAuth flow will generate incorrect URLs.
It might be possible to update this to use the public_url values instead. In #334, there was also a request to use theX-Forwarded-Host header instead of the normal Host header. If you are unable to set the Host header in your proxy, does it set the forwarding headers instead?
I'm building the reverse proxy in JS (to run in Lambda). We are using the node.js fetch function. That is not allowed to override/set the host header. But I can set any other header.
Is a PR welcome?
Yes, I'm happy to review a PR if you'd like to try fixing this. I think the easiest option is probably to use the existing oauth2.WithRedirectURL option to set the redirect URL based on the public_url value.
If you'd like to support other headers instead, I think we first need to update https://github.com/palantir/go-githubapp to enable that in the oauth2 package.