Top Menu

Jump to content
Home
    Modules
      • Projects
      • Activity
      • Work packages
      • Gantt charts
      • Calendars
      • Team planners
      • Boards
      • News
    • Getting started
    • Introduction video
      Welcome to OpenProject Community
      Get a quick overview of project management and team collaboration with OpenProject. You can restart this video from the help menu.
    • Help and support
    • User guides
    • Videos
    • Shortcuts
    • Community forum
    • Enterprise support
    • Additional resources
    • Data privacy and security policy
    • Digital accessibility (DE)
    • OpenProject website
    • Security alerts / Newsletter
    • OpenProject blog
    • Release notes
    • Report a bug
    • Development roadmap
    • Add and edit translations
    • API documentation
  • Sign in
      Forgot your password?

      or sign in with your existing account

      Google

Side Menu

  • Overview
  • Activity
    Activity
  • Roadmap
  • Work packages
    Work packages
  • Gantt charts
    Gantt charts
  • Calendars
    Calendars
  • Team planners
    Team planners
  • Boards
    Boards
  • News
  • Forums
  • Feature tour
    Feature tour

Content

You are here:
  1. Forums
  2. Support Installation & Updates

SSL redirection with "redirect_to"

Added by Timothy Overly over 10 years ago

I have OpenProject running behind ssl on apache. It works great except for several places where the server is redirecting the response to http:// and not https://. It works fine most of the time, but when the calls are ajax, an error in the browser is sometimes thrown. Chrome will not continue, while firefox will show the page. So it seems like a browser choice on what to reject.

I went ahead and added some logging to the location I was having troubles: the timelines controller.

If I go to http://my.openproject/projects/process-implementation/timelines/3 and click on the link of that process (top pop out the details), I get the following logs:

Redirected by /home/openproject/openproject/app/controllers/timelines_controller.rb:43:in `index’
Redirected to http://my.openproject/projects/process-implementation/timelines/3?layout=false

This seems like the “settings” in the installation for HTTPS isn’t being used for redirection. Maybe it should?

The error I get in chrome:

[blocked] The page at ‘https://xxx/projects/spida/timelines/2’ was loaded over HTTPS, but ran insecure content from ‘http://xxx/projects/spida/timelines/2?layout=false’: this content should also be loaded over HTTPS.


Replies (5)

RE: SSL redirection with "redirect_to" - Added by AmfistomosAtlas . almost 8 years ago

This happens on my installation as well.

Any news here?

RE: SSL redirection with "redirect_to" - Added by AmfistomosAtlas . almost 8 years ago

Solved by a temporary workaround until it is properly resolved(?) by the open project team

The workaround is to create two Virtual Hosts one on port 80 and one on port 443.

The VirtualHost on port 80 will simply rewrite any incoming requests to port 443

e.g.

<VirtualHost *:80>
     ....
     RewriteEngine On
     RewriteCond %{HTTP_HOST} ^openproject\.example\.net$
     RewriteRule ^(.*)$ https://openproject.example.net/$1 [R=302,L]
</VirtualHost> 

<VirtualHost *:443>
    ....
    ProxyPreserveHost on
    ProxyPass / http://localhost:6000/
    ProxyPassReverse / http://localhost:6000/
</VirtualHost>

RE: SSL redirection with "redirect_to" - Added by otheus uibk over 7 years ago

I also sometimes have this problem — right after login andoccasionally on changing packages. I cannot use redirection on testing due to port restrictions.

RE: SSL redirection with "redirect_to" - Added by otheus uibk over 7 years ago

Fixed in 6.1.5. https://community.openproject.com/projects/openproject/work_packages/24622/activity
But sometimes broken with pop-up/drop-down menus in 7.x. See https://community.openproject.com/projects/openproject/work_packages/details/25598/overview

RE: SSL redirection with "redirect_to" - Added by Oliver Günther over 7 years ago

If you’re terminating SSL at your load balancer or on the apache installation, please ensure you set the “X-Forwarded-Proto” header to https. Rails/Rack uses those to identify whether it should build URLs as https.

Additionally, for internal redirecting (e.g., before login), you’ll need to set the protocol setting to “https” in the System settings of OpenProject.

Setting the header for an Apache installation

RequestHeader set X-Forwarded-Proto "https"

If you let the OpenProject wizard set up the Apache installation, it will set this from an include in /etc/openproject/addons/apache2/conf/includes/vhost/ssl.conf.

Best,
Oliver

  • (1 - 5/5)
Loading...