8

I have set up GeoServer to run behind an Nginx proxy as follows:

listen 443 ssl http2 ;
listen [::]:443 ssl http2 ;

location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto http;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://127.0.0.1:8080/geoserver/;
}

It is serving up map layers perfectly this way. However, when I try to log into the admin panel, I get the following error:

HTTP ERROR 500

Problem accessing /geoserver/web/;jsessionid=swynjc84o5oz1k0uu6xkhf9c7. Reason:

    Server Error
Caused by:

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"
    at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:265)
    at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:245)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
    at org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:141)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.LoggingFilter.doFilter(LoggingFilter.java:90)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:79)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:42)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:46)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:42)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
    at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
    at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
    at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)
    at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
    at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
    at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
    at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:215)
    at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:110)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
    at org.eclipse.jetty.server.Server.handle(Server.java:499)
    at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:310)
    at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)
    at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
    at java.lang.Thread.run(Thread.java:748)

I'm not very adept at Java server configurations, and only tangentially with Nginx administration. My guess is that there is some issue here in the way Nginx is proxying requests.

I have searched for answers on this issue, but only come up with solutions for Apache servers.

Update: after some more testing, I found out that I can get the admin web portal working using the following:

location /geoserver/ {
    proxy_pass http://127.0.0.1:8080/geoserver/;
}

I think this narrows the issue down to Nginx configuration. Here's what I'm trying to achieve: use a URL like https://geoserver.myserver.com/[...] instead of using https://geoserver.myserver.com/geoserver/[...].

Improve this question
2
  • Probably needs fixing in server.xml file on Tomcat
    – nmtoken
    Commented Dec 22, 2018 at 9:28
  • I had the same problem using Apache2 and was also able to solve it by appending /geoserver to the proxypass address. Thanks!
    – alex_danielssen
    Commented Jan 9, 2020 at 22:33

2 Answers 2

Reset to default
8

I was able to get it working with the following Nginx settings:

location / {
    proxy_pass http://127.0.0.1:8080/geoserver/;
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

location /geoserver/ {
    proxy_pass http://127.0.0.1:8080/geoserver/;
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

To get layer previews to work, I also added my domain name under Settings > Global > Proxy Base URL in the GeoServer admin site:

https://mydomain.com

and make sure to check Use headers for Proxy URL.

After that I reloaded the configuration

Server Status > Reload

reloaded Nginx

sudo service nginx reload

and restarted GeoServer

./bin/shutdown.sh
./bin/startup.sh

What this achieves:

  • Puts the site behind SSL.
  • WMS URLS do not include the redundant geoserver directory.
  • The admin portal now works and lets users log in.

What I haven't been able to get working yet:

  • The URLs in the admin portal still contain the geoserver folder, as in https://geoserver.myserver.com/geoserver/web, for many pages. This doesn't seem to affect functionality, though, and since it's only in the admin portal, I'll be the only one who sees it.
Improve this answer
3
  • This location blocks configuration works for me for http only. When I add listen 443 ssl and SSL certificates instead of just listen 80, it loads the geoserver home page with https, but admin login redirects to http://<my-host>/geoserver/j_spring_security_check showing The information you’re about to submit is not secure. Is there something that I am missing in the configuration?
    – AnjK
    Commented Feb 28, 2022 at 8:08
  • Did you ever find a solution to the login form redirect problem?
    – Shayne
    Commented Nov 24, 2022 at 5:31
  • @Shayne I'm not sure that I have, it has been some time since I worked with geoserver due to a change in employment.
    – mike.bronner
    Commented Nov 25, 2022 at 13:58
2

This is a known issue and is due to an (unplanned) increase in security when Spring was upgraded.

One suggested work around is to add 

<session-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

to the web.xml file.

Improve this answer
1
  • While I have seen numerous articles and posts referencing this issue, I think it may have been resolved, at least on Linux, as I was able to get it working without making this change, and prior I had it working (but in that case WMS URLs wouldn't work). I posted my solution to get it working, I hope I didn't miss anything. Thanks for your suggestion, though. :)
    – mike.bronner
    Commented Dec 23, 2018 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.