Wordpress Installation behind reverse-proxy ssl redirect loop

[costasd]

Hello,

In my job, we are evaluating wordpress for our main site, and we seem to have a little problem with our setup.

First of all, our setup:
We use a pretty common setup with reverse proxy(nginx) in front of our LAMP stack. Nginx serves static files(e.g. images) and proxy-passes all other requests to apache2. Nginx handles both http & https, speaking http to backend(apache2)

The problem:
In setups like that, some server variables, are not used. This is why you have to use mod-rpaf on apache to get the client ip.
One of those variables, is $_SERVERHTTPS?.
So in a setup with reverse-proxy in front, you have to set a variable $_SERVERHTTP_X_FORWARDED_PROTO? with value 'https', to make backend realize that its 'real' url is an https one.

Wordpress checks only for the $_SERVERHTTPS? variable, and gets caught in an endless loop redirection from https to http to https and so on. The way we got over that, is to check for the $_SERVERHTTP_X_FORWARDED_PROTO? header in wp-include/functions.php:is_ssl() function.

I'm submitting also our 3-line patch, in case anyone has the same problem. Patch tested and works with nginx reverse-proxy.

I'm tagging it as a defect/bug, if you think it is not a bug, please re-tag it.

Thanks in advance,
Costas

You should set $_SERVER['HTTPS'] to equal $_SERVER['HTTP_X_FORWARDED_PROTO'] in your wp-config.php file. This isn't an issue for core to solve.

Ah nice, thanks a lot :)

I am closing it

Cheers :)

I have added some documentation on this to ​http://codex.wordpress.org/Administration_Over_SSL

I hope you'll reconsider including this in the core function since I noticed several people having this problem while I was searching, and it was quite difficult to track down a solution. Adding the extra check would be more likely to behave correctly out of the box.

This has also been discussed elsewhere. See http://core.trac.wordpress.org/ticket/19337#comment:4. Thanks for adding a note to the Codex.

#24394 was marked as a duplicate.