NC encounters redirect loop due to URL rewriting when used as backend to embedded podcast player on website

Hello all,

I just wanted to reach out because I feel that I’m out of my league with this one. All of the details shared here are in a development environment with disposable details/users/passwords/etc.

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Version details:

This is a docker container:
Nextcloud version (eg, 18.0.2): apache-18.0.4
Operating system and version (eg, Ubuntu 20.04): Debian GNU/Linux 10 (buster)
Apache or nginx version (eg, Apache 2.4.25): Apache/2.4.38
PHP version (eg, 7.1): PHP 7.3.18

The issue you are facing:

I’m trying to embed a podcast player into my website that uses Nextcloud as a backend. I’ve been able to point to the specific files inside of a shared directory:

$ curl -v https://podcastdev2.ourcompose.com/nextcloud/s/XkqezdGFSCKoJEM/download?path=/Audio&files=episode-3-episode-the-third.mp3 --output episode-3-episode-the-third.mp3

Which is able to get me that exact episode. So far so good. The podcast player at the demo site is from Podigee.

The problem comes when I try to use the player with the nextcloud share. If I open a browser window private browsing mode, everything works perfectly the first time. However, all subsequent attempts to use the player fail. If I close out the private browsing window and try it again, it works (again) perfectly the first time, but all subsequent attempts to use the player fail.

What I see the following when I’m inspecting my webpage is that an HTTP GET is sent, and gets 302’d. The location it gets 302’d to is the URL with the first 9 characters overwritten with index.php:

Headers:
Request URL: https://podcastdev2.ourcompose.com/nextcloud/s/XkqezdGFSCKoJEM/download?path=/Audio&files=episode-2-second-episode.mp3
...
Status Code: 302
Location: /nextcloud/index.phpFSCKoJEM/download?path=/Audio&files=episode-2-second-episode.mp3

Keep in mind THIS ONLY HAPPENS AFTER THE INITIAL SUCCESSFUL REQUEST. This then redirects me to a loop that eventually times out. Additionally, the 302 does not occur when I block cookies from my NC instance (with Chrome’s uMatrix addon).

One last detail is that this docker container sits behind an nginx reverse proxy. I’ll share the details below. Basically it’s there to redirect the nextcloud subdirectory to the nextcloud docker container as its upstream.


FWIW, I did try to add the following line to .htaccess at the end of the RewriteCond rules under the Options -MultiViews section:

RewriteCond %{REQUEST_URI} !^/s/

That ended up preventing me from copying down the individual file and rather the entire shared directory was retreived.


TLDR:

/nextcloud/s/XkqezdGFSCKoJEM/download?...

Gets rewritten (302’d) as -->

/nextcloud/index.phpFSCKoJEM/download?...

inside of an embedded media player every time after the very first load, when I don’t block cookies.


Is this the first time you’ve seen this error? (Y/N): Yes, but is is reproducible.

Steps to replicate it:

  1. Open Private Browsing Window
  2. Navigate to the example JS Fiddle
  3. Press the Play button - observe that the audio plays
  4. Reload the page
  5. Press the Play button - observe that the audio does not play
  • If you want, I would recommend, pulling up the web console and going to the “Network” tab to view the redirects.
  • Additionally, you might want to check out what happens when the NC cookies are deleted and the browser is refreshed.

Please let me know if you might have any recommendations of what I should focus my attention on next for this.

Logs

The logs below are during a brand new session that should demonstrate the behavior where it works initially, then subsequent runs fail.

The output of your Nextcloud log in Admin > Logging:

The Admin Logging lines didn’t fit so I am going to try to upload them if I can.

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php
$CONFIG = array (
  'htaccess.RewriteBase' => '/',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'apps_paths' =>
  array (
    0 =>
    array (
      'path' => '/var/www/html/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 =>
    array (
      'path' => '/var/www/html/custom_apps',
      'url' => '/custom_apps',
      'writable' => true,
    ),
  ),
  'passwordsalt' => '**********',
  'secret' => '************',
  'trusted_domains' =>
  array (
    0 => 'podcastdev2.ourcompose.com',
  ),
  'datadirectory' => '/var/www/html/data',
  'dbtype' => 'mysql',
  'version' => '18.0.4.2',
  'overwrite.cli.url' => 'http://localhost',
  'overwriteprotocol' => 'https',
  'overwritewebroot' => '/nextcloud',
  'dbname' => 'nextcloud',
  'dbhost' => 'database',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'nextcloud',[Sun May 24 22:34:14.313306 2020] [rewrite:trace3] [pid 28] mod_rewrite.c(483): [client 65.60.241.40:0] 65.60.241.40 - - [podcastdev2.ourcompose.com/sid#7f50bd49ef00][rid#7f50c07198e8/initial/redir#1] [perdir /var/www/html/] strip per-dir prefix: /var/www/html/index.php -> index.php, referer: https://cdn.podigee.com/
[Sun May 24 22:34:14.313309 2020] [rewrite:trace3] [pid 28] mod_rewrite.c(483): [client 65.60.241.40:0] 65.60.241.40 - - [podcastdev2.ourcompose.com/sid#7f50bd49ef00][rid#7f50c07198e8/initial/redir#1] [perdir /var/www/html/] applying pattern '.*' to uri 'index.php', referer: https://cdn.podigee.com/
[Sun May 24 22:34:14.313314 2020] [rewrite:trace5] [pid 28] mod_rewrite.c(483): [client 65.60.241.40:0] 65.60.241.40 - - [podcastdev2.ourcompose.com/sid#7f50bd49ef00][rid#7f50c07198e8/initial/redir#1] setting env variable 'HTTP_AUTHORIZATION' to '', referer: https://cdn.podigee.com/
[Sun May 24 22:34:14.313317 2020] [rewrite:trace3] [pid 28] mod_rewrite.c(483): [client 65.60.241.40:0] 65.60.241.40 - - [podcastdev2.ourcompose.com/sid#7f50bd49ef00][rid#7f50c07198e8/initial/redir#1] [perdir /var/www/html/] strip per-dir prefix: /var/www/html/index.php -> index.php, referer: https://cdn.podigee.com/

  'dbpassword' => '********',
  'instanceid' => 'oc6l7o4vvb9d',
  'installed' => true,
);

The output of your Apache/nginx/system log in /var/log/____:

The Apache logs didn’t fit, so I’m going to find a way to upload them here for you.

Here’s the conf and the logs from my nginx reverse proxy too:

location /nextcloud/ {
    proxy_headers_hash_max_size 512;
    proxy_headers_hash_bucket_size 64;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    add_header Front-End-Https on;
    proxy_pass   http://nextcloud/;
}
2020/05/24 22:52:47 [notice] 1#1: start worker process 6
2020/05/24 22:53:54 [warn] 6#6: no resolver defined to resolve ocsp.int-x3.letsencrypt.org while requesting certificate status, responder: ocsp.int-x3.letsencrypt.org, certificate: "/etc/letsencrypt/live/podcastdev2.ourcompose.com/fullchain.pem"
2020/05/24 22:53:54 [warn] 6#6: *1 an upstream response is buffered to a temporary file /var/cache/nginx/proxy_temp/1/00/0000000001 while reading upstream, client: 65.60.241.40, server: podcastdev2.ourcompose.com, request: "GET /nextcloud/s/XkqezdGFSCKoJEM/download?path=/Audio&files=episode-2-second-episode.mp3 HTTP/1.1", upstream: "http://172.18.0.5:80/s/XkqezdGFSCKoJEM/download?path=/Audio&files=episode-2-second-episode.mp3", host: "podcastdev2.ourcompose.com", referrer: "https://cdn.podigee.com/"
65.60.241.40 - - [24/May/2020:22:53:55 +0000] "GET /nextcloud/s/XkqezdGFSCKoJEM/download?path=/Audio&files=episode-2-second-episode.mp3 HTTP/1.1" 206 7837824 "https://cdn.podigee.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:09 +0000] "GET /nextcloud/s/XkqezdGFSCKoJEM/download?path=/Audio&files=episode-2-second-episode.mp3 HTTP/1.1" 302 0 "https://cdn.podigee.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:09 +0000] "GET /nextcloud/index.phpFSCKoJEM/download?path=/Audio&files=episode-2-second-episode.mp3 HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:10 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:10 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:10 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:10 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:10 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:10 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:11 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:11 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:11 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:11 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:11 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:11 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:12 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:12 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:12 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:12 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:12 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:13 +0000] "GET /nextcloud/index.php HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"
65.60.241.40 - - [24/May/2020:22:54:13 +0000] "GET /nextcloud/login HTTP/1.1" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0" "-"

EDIT:

Bump. I know this is complicated, I’m just hoping that someone else understands the internals of NC cookies more than I do to point me in the right direction. I’m thinking about leaving this instance up until Sunday, then I would have to spin it back up to reproduce if anyone wanted to see the errors.