IQSS
SignedUrl Fix when using http connector
What this PR does / why we need it:
In proxy configurations where the SSL connection is terminated in the proxy and Dataverse is then contacted over http (e.g. using
proxy_pass http://localhost:8080/;
in nginx, signed URLs currently fail because they are signed as https://... urls but Dataverse receives a call to the http://... form of the URL (hence the url strings being signed/verified differ by one 's' character.
This has also been seen when using Anubis and it's forwarding to Dataverse.
This PR adds support for Dataverse to use the value of the X-Forwarded-Proto HTTP header and, if that is 'https', to restore the original https form of the URL before trying to test the signature. The result is that signatures can work in such configurations.
Which issue(s) this PR closes:
- Closes #
Special notes for your reviewer:
Suggestions on how to test this: Should be able to configure Anubis (as on demo) or adjust an nginx or apache proxy to forward to Dataverse over http - verify that signed URLs for external tools fail if the X-Forwarded-Proto Header is missing or (easier to test) is set incorrectly to http. Turning on the fine logging for the SignedUrlAuthMechanism class will show when the signed url is received starting with http and the X-Forwarded-Proto header is set to https allowing the signed url to be validated.
Does this PR introduce a user interface change? If mockups are available, please link/include them here:
Is there a release notes update needed for this change?:
Additional documentation:
Entry point to docs: https://dataverse-guide--11787.org.readthedocs.build/en/11787/api/external-tools.html#signed-urls
