Comments (4)
I'll have to look into this further, but I suspect that what is happening is that in the absence of a vhost listening on 443 for domain.two
, the traffic is flowing instead to the the vhost for domain.one
, because, as the only vhost listening on 443, it would be the default vhost for 443.
If you were to install platform-wide SSL using a wildcard cert, this issue would go away, because it would explicitly introduce a default vhost listening on 443 that would be a catch-all for any HTTPS traffic that didn't match any other vhost.
Note that In the absence of a platform-wide, wildcard SSL cert, it's not possible to explicitly implement a catch-all, default vhost... because what cert would we use?
I don't see this as a bug so much as just the way Nginx works. That being said, I can look into what other options might exist for simply dropping requests that aren't an exact match for any of the defined vhosts.
from router.
So what I could do is if a platform-wide wildcard cert has not been provided, I could use a self-signed cert for a default vhost listening on 443. It would return just return 404s. The downside is anyone requesting HTTPS for a domain that doesn't support it will get a cert warning that would stop them from ever getting the 404 (unless the willfully ignore the cert warning). But this is still probably better than the behavior you have observed.
from router.
I see. With the background info provided, I can proceed with writing a test using a wildcard cert to get the behavior I'm looking for. That being said, if the 'fix' sounds reasonable, apart from simply representing an adjustment to help testing (although it is nice when those happen :)), then I'd be in support of it.
from router.
@vdice note that providing an SSL cert for use platform-wide must be done at the time of platform installation, so it requires an addition to the chart. I'm not sure if your tests currently support that. Alternatively, I guess the manifest for it could just be submitted directly using kubectl.
Here's the doc on how it's done:
https://github.com/deis/router#default-certificate-example
from router.
Related Issues (20)
- need annotation for nginx proxy_buffer_size HOT 5
- When using proxy protocol, X-Forwarded-For header should be set to $proxy_protocol_addr HOT 4
- TCP support for Deis applications HOT 22
- HPKP Public-Key-Pins Header HOT 7
- Per domain real_ip_header HOT 1
- When <sub>.example.com domain is added to app on example.com cluster, ssl configuration is missing HOT 1
- Clickjacking prevention header? X-Frame-Options HOT 2
- Random 502 bad gateway HOT 10
- There's no point in having Travis build HOT 5
- Proxy Protocol Port not used to determine Access Scheme HOT 7
- Trouble setting service_annotations via chart values file HOT 4
- Proposal: Add aws load balancer timeout override to service template HOT 2
- Router makes zombies permanently HOT 9
- Claiming a reserved name for the router HOT 3
- Documentation still has some references to Helm Classic HOT 3
- GKE Failed: Create Address error` HOT 2
- Custom "Site Maintenance" page HOT 3
- Deis router picks up non-Deis traffic HOT 15
- Config builder silently fails with missing annotations HOT 2
- Support non-HTTP, streaming apps HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from router.