ELB背后的Symfony2重定向到http而不是https

Question

问题:

• 用户使用https://example.com/login登录
• 身份验证已获批准
• 在security.yml中配置,Symfony2在登录后将用户重定向到配置文件页面.
• 但它会将它们重定向到错误的网址http://example.com/homepage

security.yml:

security:

    encoders:
        FOS\UserBundle\Model\UserInterface: sha512

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    providers:
        fos_userbundle:
            id: fos_user.user_provider.username_email

    firewalls:
        main:
            pattern:    ^/
            form_login:
                check_path: /login_check
                login_path: /login
                default_target_path: /profile
                provider: fos_userbundle
            logout:
                path:   /logout
                target: /splash
            anonymous: ~

    access_control:
        - { roles: ROLE_USER, requires_channel: https }
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY, requires_channel: https }

    acl:
        connection: default

环境架构:

Server1和Server2保存Symfony2应用程序.

题:

如何强制Symfony生成重定向URL与https协议而不是http？

到目前为止,我已经查看了这些文档,并且解决方案在我的情况下不起作用:

• http://symfony.com/doc/current/cookbook/routing/scheme.html

Answer 1

看一眼

供应商/ symfony的/ symfony的/ SRC/Symfony的/组件/ HttpFoundation/Request.php

AWS ELB使用HTTP_X_FORWARDED_PROTO和HTTP_X_FORWARDED_PORT,而Symfony查看X_FORWARDED_PROTO和X_FORWARDED_PORT标头以判断连接及其安全状态.

你可以尝试在trustedHeaders中更改这些键,虽然我不建议直接更改它们但是找到一种方法来覆盖它们.

protected static $trustedHeaders = array(
        self::HEADER_CLIENT_IP    => 'X_FORWARDED_FOR',
        self::HEADER_CLIENT_HOST  => 'X_FORWARDED_HOST',
        self::HEADER_CLIENT_PROTO => 'HTTP_X_FORWARDED_PROTO',
        self::HEADER_CLIENT_PORT  => 'HTTP_X_FORWARDED_PORT',
    );

参考 - http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/TerminologyandKeyConcepts.html#x-forwarded-for

Answer 2

1. 确保正确设置trusted_hosts和trusted_proxies配置属性.
2. 请确保您的负载均衡器增加了X-Forwarded-For,X-Forwarded-Host,X-Forwarded-Port和,什么是最重要的,X-Forwarded-Proto头到HTTP请求发送到应用程序.

文档:信任代理.

编辑:

正如@ A23建议你还应该检查ELB是否使用"标准"标题名称.如果没有,请使用以下方法之一进行更改:

Request::setTrustedHeaderName(Request::HEADER_CLIENT_IP, 'X-Proxy-For');
Request::setTrustedHeaderName(Request::HEADER_CLIENT_HOST, 'X-Proxy-Host');
Request::setTrustedHeaderName(Request::HEADER_CLIENT_PORT, 'X-Proxy-Port');
Request::setTrustedHeaderName(Request::HEADER_CLIENT_PROTO, 'X-Proxy-Proto');