Haproxy removing headers when using http-request return code - rest

I am trying to add OPTIONS inside haproxy instead adding it in every rest api. I am using something like this:
acl is_options method OPTIONS
use_backend cors_backend if is_options
backend cors_backend
http-request return status 200
In previous part of haproxy.cfg I added some CORS headers and everything works fine for api calls going to my rest api servers, but when I use cors_backend to send response directly from haproxy, all headers I added above are removed.
Is this expected, is there some way to preserve headers? Maybe it is not good idea to add OPTIONS to haproxy at all

Related

HAProxy 1.5 URL/URI Redirects to a different domain

I'm looking for a method to redirect visitors from https://site1.co.uk to https://site2.co.uk in HAProxy. I also need to redirect sub-pages (i.e. https://site1.co.uk/page1) to similar pages on site2.co.uk but using specific URLs. I have stuck a sample below of what I'd like to achieve if that helps...
Home redirect:
https://site1.co.uk -> https://site2.co.uk
Sub redirect:
https://site1.co.uk/first-page.html -> https://site2.co.uk/about-us.html
I've been searching for the last day or so for a simple solution to this problem and have been unable to find anything that does the trick.
I'm using HAProxy 1.5 (version required for a specific project) and any help would be much appreciated!
UPDATE
Things I've tried...had to remove HTTPS www.'s due to account limit.
redirect prefix site2.org.uk/subpage2/endresult2.html if { hdr(host) -i site1.org.uk }
redirect prefix site2.org.uk/subpage2/endresult2.html if { hdr(host) -i site1.org.uk/site1page.html }
Line 1: redirects correctly.
Line 2: End result is site2.org.uk/subpage2/endresult2/site1page.html - this is incorrect and should not include the site1page.html page on the end.
End result should be site2.org.uk/subpage2/endresult2 - this is how it I would like it to appear.
The server that HAProxy is on also serves multiple sites with different URLs. The above code is also redirecting them yet it shouldn't interact. How can I prevent this from happening?
UPDATE 2
I've noticed that when I enable a redirect, it's affecting my other sites which route through HAProxy and not just the one I'm trying to redirect (i.e. site1)

if you need to redirect your URL, you can check below link:
How to redirect URL with HAProxy
in haproxy you should use configuration like above

Although not technically the answer I wanted...I realised that I could redirect using the httpd configuration file instead of HAProxy. In the end that was the easiest option for a newbie like myself. Time will tell if this performs well...

Add Header taken from query parameter

In my application to like to do a navigate to a link. Unfortunately, I am not able to add an access token to the Authorization header.
For this reason, I like to add it as a query parameter. When the request is processed in HAProxy I like to retrieve query parameter and add an Authorization header using the parameter value.
I would be very happy if someone has an idea why it is not working;
The following configuration I have added to HAProxy configuration. We testing I notice that the header is added, as it overwrites the Authorization when I add a header for test purpose.
Thanks,
Andreas
http-request set-var(req.token) urlp(token)
http-request set-header Authorization var(req.token)

You're missing %[...] around your set-header fmt expression, namely:
http-request set-var(req.token) urlp(token)
http-request set-header Authorization %[var(req.token)]

HAProxy change header

I want to configure my HAProxy (V1.7) to change the Location-field in the header of the server-response before sending it back to the client. I tried various options but wasn't able to get the right result. Any ideas?

XHR and Access-Control-Allow-Origin

One of the method that I am testing sends a XMLHttpRequest to "http://localhost:4848/qrs/extension/schema?xrfkey=asdfasdfdf". I am getting an error which looks like this -
XMLHttpRequest cannot load http://localhost:4848/qrs/extension/schema?xrfkey=asdfasdfdf. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9875' is therefore not allowed access. The response had HTTP status code 404.
Now I understand that test are served on "localhost:9876", and trying access localhost:4848 is actually violating cross domain policy. I have seen the karma proxy settings and tried -
proxies: {
'/qrs': 'http://localhost:4848/qrs'
}
But doing this actually serves my content from "http://localhost:9876/qrs/extension/schema?xrfkey=asdfasdfdf". But this way my client code will not work. Because client code directly sends XHR request to "http://localhost:4848/qrs/.....", but NOT to "http://localhost:9876/qrs/.....".
Any suggestion how can I solve this?
Also, wouldn't it be better to have an option to set different headers in the config file? At lest we know that we are talking about test here (I mean not in production).
Thanks in advance.

restler 3 cross domain not working

My restler 3 api works fine on local test server and works fine on production server if calls from that same server, but if I make the call remotely then it fails.
Using the same rest client with the luracast online examples it works fine with remote call so must be something in my configuration (either my api or my production server).
I found mention of need to send headers and so tried adding these headers to index.php file:
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, PATCH, DELETE');
header('Access-Control-Max-Age: 1000');
header('Access-Control-Allow-Headers: *');
But that didn't help. Using RESTClient addon in firefox, I can see that those headers are sent, and the browser will show the data both locally and remotely, whether I use those header commands or not.
Here's a sample call:
https://api.masterpiecesolutions.org/v1/artists/?key=A4oxMOYEUSF9lwyeFuleug==
My index.php for that call uses this, with 2nd param to map to root level
$r->addAPIClass('Artists', '');
Don't know if that is relevant.
Also, the production server is Amazon EC2, so perhaps has something to do with security policy?
Or, maybe it's some other header issue? In google chrome, using Advanced Rest Client extension, it gives status of 403 Forbidden and Content-Type is text/plain (whether using local or remote server) so it won't work at all, unlike the firefox addon.
I also see use of $_SERVER['HTTP_ORIGIN'] in Restler.php, and this doesn't appear to be supported everywhere yet?

* is not a valid value for the Access-Control-Allow-Headers response header. You need to list out every non-simple request header. For example:
header('Access-Control-Allow-Headers: Content-Type');
Also consider putting a single origin value or just * for the Access-Control-Allow-Origin header. I just visited your sample url and there are multiple values in that header. Although this should work according to the CORS spec, it is not very widely adopted yet.
Lastly I noticed that the server was setting Access-Control-Allow-Credentials: true. If you set this to true, then you also need to do two other things:
The value of the Access-Control-Allow-Origin header must be the value of the Origin (e.g. http://localhost, it can not be *).
You will need to set xhr.withCredentials = true; in your JavaScript client code.
If you are just testing, you should try to get things working without setting the Access-Control-Allow-Credentials header. It will make things easier to debug.

The problem, for me at least, was using SSL and the restclient class didn't accommodate that.
So I added (to my RestClient.class.php from phpclasses.org)
curl_setopt($this->curl, CURLOPT_SSL_VERIFYPEER, false); // for SSL
and now it works.
Also required was setting
public static $crossOriginResourceSharing = true;
in Defaults.php for Restler 3.