Replace `ReverseProxied` with werkzeug/middleware/proxy_fix.py #112

New issue

Closed

opened 2026-05-12 08:33:12 +00:00 by jgroman · 0 comments

jgroman commented

2026-05-12 08:33:12 +00:00

Owner

Copied from https://pagure.io/elections/issue/106 :

This app uses a ReverseProxied wrapper for the WSGI app that attempts to cope with it being reverse-proxied (in testdays/app.py).

werkzeug X-Forwarded-For Proxy Fix seems to be a better implementation of this, which is documented by flask upstream and handles things like there being multiple comma-separated values in the forwarded headers. It handles more headers, and allows specifying how many levels of proxy there are known to be for each header.

In all respects it seems like a superior replacement (which we don't have to maintain), so we should switch to it, I think.

Open questions: which of the headers are proxied for the Fedora deployment, and how many levels of proxying should we configure (assuming we go back to the append setting for haproxy.router.openshift.io/set-forwarded-headers)? And should we make the wrapper setup configurable to allow for other deployments and for easy changes if our proxying setup changes in future?

See https://forge.fedoraproject.org/infra/tickets/issues/12997 for some background here.

Copied from <https://pagure.io/elections/issue/106> : This app uses a ReverseProxied wrapper for the WSGI app that attempts to cope with it being reverse-proxied (in `testdays/app.py`). [werkzeug X-Forwarded-For Proxy Fix](https://werkzeug.palletsprojects.com/en/stable/middleware/proxy_fix/) seems to be a better implementation of this, which is documented [by flask upstream](https://flask.palletsprojects.com/en/stable/deploying/proxy_fix/) and handles things like there being multiple comma-separated values in the forwarded headers. It handles more headers, and allows specifying how many levels of proxy there are known to be for each header. In all respects it seems like a superior replacement (which we don't have to maintain), so we should switch to it, I think. Open questions: which of the headers are proxied for the Fedora deployment, and how many levels of proxying should we configure (assuming we go back to the `append` setting for `haproxy.router.openshift.io/set-forwarded-headers`)? And should we make the wrapper setup configurable to allow for other deployments and for easy changes if our proxying setup changes in future? See <https://forge.fedoraproject.org/infra/tickets/issues/12997> for some background here.

jgroman added the

Work Item

Bug

points

labels

2026-05-12 08:33:12 +00:00

jgroman referenced this issue from a commit

2026-06-11 13:37:18 +00:00

Replace ReverseProxied with werkzeug ProxyFix

jgroman self-assigned this

2026-06-12 13:28:47 +00:00

jgroman added this to the Sprint 12 project