Search code examples
djangoreverse-proxyshimmercat

ShimmerCat with reverse proxy when using "the old way"


I have used ShimmerCat with sc-tool to connect to my development sites as described here, and everything has worked always like a charm with it, but I also wanted to follow the "old way" configuring my /etc/hosts. In this case I had a small problem, the server ran ok, and I could access to my development site (let's say that I used https://www.example.com:4043/), but I'm also using a reverse proxy as described on this article, and on the config file reference. It redirects to a Django app I'm using. Let's say it is my devlove.yaml config file:

---
shimmercat-devlove:
    domains:
        www.example.com:
            root-dir: site
            consultant: 8080
            cache-key: xxxxxxx
        api.example.com:
            port: 8080

The problem is that when I try to access to a URL that requests the API, a 404 response is sent from the API. Let me try to explain it through an example. I try to access to https://www.example.com:4043/country/, and on this page I do a request to the API: /api/<country>/towns/, then the API endpoint is returning a 404 response so it is not finding this URL, which does not happen when using Google Chrome with sc-tool. I had set both domains www.example.com, and api.example.com on my /etc/hosts. I have been trying to solve it, but without any luck, is there something I'm missing? Any help will be welcome. Thanks in advance.


Solution

  • With a bit more of data, we may be able to find the issue. In the meantime, here is a list of troubleshooting tips:

    Possible issue: DNS is cached in browser, /etc/hosts is not being used (yet)

    This can happen if somehow your browser has not done a DNS lookup since before you changed your /etc/hosts file. Then the connection is going to a domain in the Internet that may not have the API endpoint that you are calling.

    Troubleshooting: Check ShimmerCat's log for the requests. If this is the issue, closing and opening the browser may solve the issue.

    Possible issue: the host header is incorrect

    ShimmerCat uses the Host header in HTTP/1.1 requests and the :authority header in HTTP/2 requests to distinguish the domains. It always discards any port number present in them. If these headers are not set or are set to a domain other than the ones ShimmerCat is configured to listen, the server will consider the situation so despicable that it will just close the connection.

    Troubleshooting: This is not a 404 error, but a connection close (if trying to connect un-proxied, directly to the SSL port where ShimmerCat is listening), or a Socks Connection Failed (if trying to connect through ShimmerCat's built-in SOCKS5 proxy). In the former case, the server will print the message "Rejected request to Just https://some-domain-or-ip/some/path" in his log, using the actual value for the domain, or "Rejected request to Nothing", if no header was present. The second case is more complicated, because the SOCKS5 proxy is before the HTTP routing algorithm.

    In any case, the browser will put a red line in the network panel of the developer tools. If you are accessing the server using curl, like this:

    curl  -k -H host:api.incorrect-domain.com https://127.0.0.1:4043/contents/blog/data-density/
    

    or like

    curl  -k -H host:api.incorrect-domain.com 
    

    (notice the --http2 parameter in the second form), you will get a response:

    curl: (56) Unexpected EOF
    

    Extra-tip: There is a field for the network address in the browser's developer tools. Check it, it may tell you something!

    Possible issue: something gets messed up when passing the request to the api back-end.

    API backends are also sensitive to the host header, and to additional things like authentication cookies and request parameters.

    Troubleshooting: A way to diagnose things is invoking ShimmerCat using the --show-proxied-headers command-line option. It makes ShimmerCat to report the proxied headers to the log:

    Issuing request with headers         :authority: api.example.com
        :method: GET
        :path: /my/api/endpoint/path/
        :scheme: https
        accept: */*
        user-agent: curl/7.47.0
    

    Possible issue: there are two instances or more of ShimmerCat running

    ...and they are using different configurations. ShimmerCat uses port sharing among several processes to increase availability. A downside of this is that is perfectly possible to mistakenly start ShimmerCat, forget about stopping it, and start it again after changing some configuration bit. The two instances will be running at the same time, and any of them will pick connections made to the listening port.

    Troubleshooting: Shutdown all instances of ShimmerCat, then double-check there are none running by using the corresponding form of the ps command, and start the server with the configuration you want.