Wordpress SSL Issue

Evessal

Good morning!

I had a question regarding an issue our web developer team was having at our university. Apparently, they are having trouble with SSL when they require users to connect to their Wordpress Server. Their server is behind our load-balancer doing SSL offloading, and as such they've now requested that our AX-3030 let the Wordpress server know which protocol (HTTP or HTTPS). From some scrounging around, I found out that the way to do this is using the HTTP_X_FORWARDED_PROTO variable. So now I want to create an aFlex script to implement this, and I was wondering if what I have written here is correct (NOTE: These examples came from an F5 iRule, so I was wondering if would translate to the A-10 aFlex?)

when HTTP_REQUEST {
HTTP::header insert X-Forwarded-Proto https
}

when HTTP_REQUEST {
HTTP::header insert X-Forwarded-Proto http
}



So basically, if the user came in on HTTP, let the Wordpress Server know that in the X-Forwarded-Proto field (Same with HTTPS). The web developers have configured their Wordpress server to look for this X-Forwarded-Proto field.

So my question is whether the script I have written above will work?

Thank you

Ehsan

JackofallTrades

Actually this is not the proper use for the xFF header. This is usually utilized for inserting the client address if SNAT is utilized. However, You are on the right track. I would ask the developers what header they would like to use. You can pick any header name you want as long as the application knows how to look for it.
applied to HTTPS Vport

when HTTP_REQUEST {
HTTP::header insert isSecure "YES"
}
applied to HTTP vPort
when HTTP_REQUEST {
HTTP::header insert isSecure "NO"
}

Hope this helps!

Evessal

Hey thanks JackofAllTrades for your quick reply, I appreciate it!

I do not want to use the xFF header though Jack, I know that the X-Forwarded-For does pass the client IP, however there is an X-Forwarded-Proto header that passes along the protocol type that traffic is hitting our load-balancer on (http://en.wikipedia.org/wiki/List_of_HTTP_header_fields, in second section titled "Common non-standard request headers"). This is what I want to use (I would use your example Jack, but our Web Developers have specifically set up their Wordpress to search for this specific header)

Will the A-10 recognize X-Forwarded-Proto? And is my syntax correct? Thanks!

JackofallTrades

I guess I read the question to fast... Yes your syntax is correct.

[Deleted User]

I tested this in my lab and it looks to be working the way you expect it. You will need to create 1 aflex for http and one for https and apply them to the respective http templates on the virtual server ports.

Here's the wireshark output for the test.

GET / HTTP/1.1
Host: 10.0.1.17
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
DNT: 1
Connection: keep-alive
X-Forwarded-Proto: http

You can also do this with http templates natively. Here's an example where I create two templates with each being applied to different virtual server ports.

slb template http app_temp_http
request-header-insert X-forwarded-Proto:http insert-if-not-exist

slb template http app_temp_https
request-header-insert X-forwarded-Proto:https insert-if-not-exist

slb virtual-server www.app.com_v1 10.0.1.17
port 80 http
name _10.0.1.17_HTTP_80
template http app_temp_http
port 443 https
name _10.0.1.17_HTTPS_443
template http app_temp_https

Evessal

Well wow! Thank you JackofallTrades, and thank you Jraasch for going so far as to testing it out on your own lab! I'm new to the scary world of load balancers and don't understand too much right now, so I really appreciate all your time and effort. Thank you also for showing me that you can do it via HTTP templates too, maybe I won't apply the aFlex script after all.

Again, thank you so much!

Ehsan

Evessal

I just thought I'd make another thank you post! I created the aFlex and placed it on our development context for our web developers, and they said it works fine and dandy! Woohoo thank you thank you thank you!!! We move it into the production environment tomorrow!