Hi all,

We're brand new to OpenProject 8.2, having just installed it onto a CentOS7 VM and requested a free trial (still awaiting approval/key).

So, we've decided to put it behind a web proxy, which adds SSL. We've left OpenProject's Apache config alone, bar switching the port it listens on.

All seems fine, and the site it being served over SSL. However, something I have just noticed is that avatar images are now broken.

Is there a different/preferred way we should serve OP over SSL, or can anyone advise how to fix the broken avatar links (I have of course tried to simply re-upload the avatar images, but no luck).

Thank you.

Elliot

I think I have fixed the broken avatar images by setting the protocol to HTTPS under the System Settings >> General.

But, I have now also noticed that if I click on any admin section which redirects to an admin/*/upsale link, such as www.mydomain.com/admin/design/upsale, then it tries to connect to HTTP. Seems like HTTP is hard-coded for these links?

Apparently, I can't even login to OP any more either, now that it's behind a secure proxy? Good stuff!

The login page just refreshes when credentials are submitted, and I get the following in the browser's developer console:

Refused to send form data to 'http://projects.my-domain.com/' because it violates the following Content Security Policy directive: "form-action 'self'".

Found a random suggestion here: https://community.openproject.com/topics/7896

Adding RequestHeader set X-Forwarded-Proto "https"

to our separate reverse proxies' virtualhost config for OP appears to have saved the day!