1

I have set up GeoServer to run behind an Nginx proxy as follows:

listen 443 ssl http2 ;
listen [::]:443 ssl http2 ;

location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto http;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://127.0.0.1:8080/geoserver/;
}

It is serving up map layers perfectly this way. However, when I try to log into the admin panel, I get the following error:

HTTP ERROR 500

Problem accessing /geoserver/web/;jsessionid=swynjc84o5oz1k0uu6xkhf9c7. Reason:

    Server Error
Caused by:

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"
    at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:265)
    at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:245)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
    at org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:141)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.LoggingFilter.doFilter(LoggingFilter.java:90)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:79)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:42)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:46)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:42)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
    at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
    at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
    at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
    at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)
    at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
    at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
    at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
    at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:215)
    at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:110)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
    at org.eclipse.jetty.server.Server.handle(Server.java:499)
    at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:310)
    at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)
    at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
    at java.lang.Thread.run(Thread.java:748)

I'm not very adept at Java server configurations, and only tangentially with Nginx administration. My guess is that there is some issue here in the way Nginx is proxying requests.

I have searched for answers on this issue, but only come up with solutions for Apache servers.

Update: after some more testing, I found out that I can get the admin web portal working using the following:

location /geoserver/ {
    proxy_pass http://127.0.0.1:8080/geoserver/;
}

I think this narrows the issue down to Nginx configuration. Here's what I'm trying to achieve: use a URL like https://geoserver.myserver.com/[...] instead of using https://geoserver.myserver.com/geoserver/[...].

  • Probably needs fixing in server.xml file on Tomcat – nmtoken Dec 22 '18 at 9:28
0

This is a known issue and is due to an (unplanned) increase in security when Spring was upgraded.

One suggested work around is to add

<session-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

to the web.xml file.

  • While I have seen numerous articles and posts referencing this issue, I think it may have been resolved, at least on Linux, as I was able to get it working without making this change, and prior I had it working (but in that case WMS URLs wouldn't work). I posted my solution to get it working, I hope I didn't miss anything. Thanks for your suggestion, though. :) – mike.bronner Dec 23 '18 at 18:04
0

I was able to get it working with the following Nginx settings:

location / {
    proxy_pass http://127.0.0.1:8080/geoserver/;
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

location /geoserver/ {
    proxy_pass http://127.0.0.1:8080/geoserver/;
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

To get layer previews to work, I also added my domain name under Settings > Global > Proxy Base URL in the GeoServer admin site:

https://mydomain.com

and make sure to check Use headers for Proxy URL.

After that I reloaded the configuration

Server Status > Reload

reloaded Nginx

sudo service nginx reload

and restarted GeoServer

./bin/shutdown.sh
./bin/startup.sh

What this achieves:

  • Puts the site behind SSL.
  • WMS URLS do not include the redundant geoserver directory.
  • The admin portal now works and lets users log in.

What I haven't been able to get working yet:

  • The URLs in the admin portal still contain the geoserver folder, as in https://geoserver.myserver.com/geoserver/web, for many pages. This doesn't seem to affect functionality, though, and since it's only in the admin portal, I'll be the only one who sees it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.