ERR_TOO_MANY_REDIRECTS after 3.2.1 -> 3.3.3 update

[blqdev]

When we update an instance from 3.2.1 to 3.3.3 (using manual install/update) we lose access with the browser showing ERR_TOO_MANY_REDIRECTS error.

We're using the same config files as before, and reverting to 3.2.1 restores access.

We also experience the error on a new 3.3.3 instance, but a new 3.2.1 instance works.

logs/leantime.log, logs/error.log and storage/logs/leantime.log are empty.

Our setup looks like this:
Internet - web server (nginx) - Leantime server (also running nginx)

We have multiple instances set up to run on their own port and subfolder on the Leantime server, so, for example, sub.domain.com/subfolder will first hit the web server then be directed to the Leantime server specifying the appropriate port (5000 in this case).

This is the nginx config file at the web server:

server {
    listen 80;

    server_name sub.domain.com;

    rewrite ^ https://$host$request_uri permanent;
}

server {
    listen 443 ssl;

    server_name sub.domain.com;

    ssl_certificate /etc/nginx/ssl/sub.domain.com/cert.pem;

    ssl_certificate_key /etc/nginx/ssl/sub.domain.com/key.pem;

    ssl_protocols TLSv1.3 TLSv1.2;

    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

    ssl_prefer_server_ciphers on;

    access_log /var/log/nginx/access.log;

    #subfolder
    location /subfolder {
        proxy_pass http://192.168.0.10:5000/subfolder;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_buffering off;
        proxy_set_header Origin '';
        proxy_set_header Referer '';
    }

}

This is the nginx config file at the Leantime server:

server {

  listen 5000;

  server_name sub.domain.com;

  # logging
  access_log /var/log/nginx/leantime.access.log;
  error_log /var/log/nginx/leantime.error.log warn;

  location /subfolder {

      root /var/www/leantime/subfolder/public/;

      try_files $uri $uri/ /subfolder/index.php?$query_string;

      rewrite ^/subfolder/leantime(/.*)$ /subfolder$1 permanent;

      location ~.php$ {
        root /var/www/leantime/subfolder/public/;

        rewrite ^/subfolder(/.*)$ $1 break;

        fastcgi_intercept_errors on;
        fastcgi_index  index.php;
        fastcgi_buffers 8 16k;
        fastcgi_buffer_size 32k;
        include        fastcgi_params;
        fastcgi_param  SCRIPT_FILENAME  /var/www/leantime/subfolder/public/$fastcgi_script_name;
        fastcgi_param  PATH_INFO $fastcgi_path_info;
        fastcgi_param  DN $ssl_client_s_dn;
        fastcgi_pass   unix:/var/run/php/php8.2-fpm.sock;
      }

      # assets, media
      location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
        rewrite ^/subfolder/leantime(/.*)$ /subfolder$1 permanent;
        rewrite ^/subfolder(/.*)$ $1 break;
        expires 7d;
        access_log off;
      }
      # svg, fonts
      location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
        rewrite ^/subfolder/leantime(/.*)$ /subfolder$1 permanent;
        rewrite ^/subfolder(/.*)$ $1 break;
        add_header Access-Control-Allow-Origin "*";
        expires 7d;
        access_log off;
      }
      # gzip
      gzip on;
      gzip_vary on;
      gzip_proxied any;
      gzip_comp_level 6;
      gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
    }
}

As mentioned, these nginx configs work for 3.2.1 but we get ERR_TOO_MANY_REDIRECTS upon updating to 3.3.3.

A fresh 3.3.3 instance also fails with the same error after redirecting to https://sub.domain.com/subfolder/install.

Do you have experience with or pointers for this issue?

[marcelfolaron]

Hi, what is your APP_URL config? For subfolder installs and reverse proxy installs it is important to set LEAN_APP_URL to the URL you are using including protocol.

[blqdev]

Here's an excerpt from the .env file:

LEAN_APP_URL = 'https://sub.domain.com/subfolder'
LEAN_APP_DIR = '/subfolder'

The configuration works fine on 3.2.1.

[marcelfolaron]

Thanks. Leantime now uses Laravel's/Symfony's default request classes and so they may need some of those for proper host identification and I believe those classes use the FORWARDED-HOST header to compare hostnames.

Couple things I would try:
For your reverse proxy add a couple proxy headers:

location /subfolder {
    proxy_pass http://192.168.0.10:5000/subfolder;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_buffering off;
    proxy_set_header Origin '';
    proxy_set_header Referer '';
}

In your Leantime nginx we can do a little clean up:

location /subfolder {
    root /var/www/leantime/subfolder/public/;
    try_files $uri $uri/ /subfolder/index.php?$query_string;

    # Remove these lines
    # rewrite ^/subfolder/leantime(/.*)$ /subfolder$1 permanent;
    
    location ~.php$ {
        root /var/www/leantime/subfolder/public/;
        rewrite ^/subfolder(/.*)$ $1 break;
        ...
    }
}

[marcelfolaron]

Alright, we'll have to dive a little deeper then. You mentioned it happened during install already so let's check that redirect:

In file: /~https://github.com/Leantime/leantime/blob/v3.3.3/app/Core/Middleware/Installed.php
Line 94

Can you add the following lines:

var_dump(BASE_URL);
dd($route);

The whole method should look like this:

private function redirectToInstall(IncomingRequest $request): Response|false
    {
        $frontController = app()->make(Frontcontroller::class);

        $allowedRoutes = ['install', 'install.update', 'api.i18n'];
        $allowedRoutes = self::dispatchFilter('allowedRoutes', $allowedRoutes);
        $route = $request->getCurrentRoute();
       var_dump(BASE_URL);
       dd($route);

        if (in_array($request->getCurrentRoute(), $allowedRoutes)) {
            return false;
        }

        $route = BASE_URL.'/install';
        $route = self::dispatchFilter('redirectroute', $route);

        return $frontController::redirect($route);
    }

This will stop the execution and should show you your APP_URL value as defined in the config.
And which "route" symfony thinks it's on.

[blqdev]

Apologies for the delay.

The output displayed after adding those lines is

string(33) "https://sub.domain.com/subfolder"
"subfolder" // app/Core/Middleware/Installed.php:97

[marcelfolaron]

Hey, we just published 3.4.2
Can you try and see if that fixes the issues you are seeing?

[blqdev]

3.4.2 and 3.4.3 still fail with the redirect error. Modifying Installed.php as before shows the following on both versions:

string(33) "https://sub.domain.com/subfolder"
"subfolder.install" // app/Core/Middleware/Installed.php:97

[marcelfolaron]

Well that gives us a little more information. The changes in the latest version were tested for reverse proxy support and the check for the subfolder uses the app_url. The fact that showed you subfolder.install means that it wasn't able to match the LEAN_APP_URL with the host received by PHP.

We are reading the host using this rule:

 if ($this->isFromTrustedProxy() && $host = $this->getTrustedValues(self::HEADER_X_FORWARDED_HOST)) {
            $host = $host[0];
        } elseif (!$host = $this->headers->get('HOST')) {
            if (!$host = $this->server->get('SERVER_NAME')) {
                $host = $this->server->get('SERVER_ADDR', '');
            }
        }

The host is being read from the header variables HOST, SERVER_NAME or SERVER_ADDR

My guess is that what actually arrives at Leantime is your ip address: 192.168.0.10:5000 instead of sub.domain.com

Going off of this stackoverflow discussion: https://stackoverflow.com/questions/39715510/nginx-when-to-use-proxy-set-header-host-host-vs-proxy-host

I would suggest to set

proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;

to

proxy_set_header Host sub.domain.com;
proxy_set_header X-Forwarded-Host sub.domain.com;

Otherwise nginx is just sending the proxy pass which is 192.168.0.10:5000

You can test what PHP is seeing by adding var_dump($_SERVER); and var_dump($_REQUEST);
This will spit out a lof of data though so might want to check one at a time.