httpd, connection lost, verification, client host...strange strange #106
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mx/AareDAQ#106
Reference in New Issue
Block a user
Need to investigate later
In /sls/mx/applications/aaredaq-pxiii/src/aare/daq/auth.py, the if not _is_loopback(client_host) is commented out to recover from the fact that:
Jul 10 13:05:51 mx-x06da-queue-01.psi.ch AareDAQ[724622]: 2026-07-10 13:05:51,868 - aareDAQ - WARNING - [auth] Rejecting X-Remote-User: client_host '129.129.110.244' is not loopback
Jul 10 13:07:17 mx-x06da-queue-01.psi.ch AareDAQ[724617]: 2026-07-10 13:07:17,924 - aareDAQ - DEBUG - [auth] /token client_host='129.129.110.244' request.client=Address(host='129.129.110.244', port=0)
Jul 10 13:07:17 mx-x06da-queue-01.psi.ch AareDAQ[724617]: 2026-07-10 13:07:17,924 - aareDAQ - DEBUG - [auth] /token client_host='129.129.110.244' request.client=Address(host='129.129.110.244', port=0)
Jul 10 13:07:17 mx-x06da-queue-01.psi.ch AareDAQ[724617]: 2026-07-10 13:07:17,926 - aareDAQ - WARNING - [auth] Rejecting X-Remote-User: client_host '129.129.110.244' is not loopback
Jul 10 13:07:17 mx-x06da-queue-01.psi.ch AareDAQ[724617]: 2026-07-10 13:07:17,926 - aareDAQ - WARNING - [auth] Rejecting X-Remote-User: client_host '129.129.110.244' is not loopback
def authenticate_from_proxy_header(request: Request) -> str:
"""
Extract the pre-authenticated username from the trusted Apache proxy header.
Only trust this header when the request originates from localhost, meaning
only the Apache proxy running on the same host can supply it.
"""
client_host = request.client.host if request.client else None
logger.debug(f"[auth] /token client_host={client_host!r} request.client={request.client!r}")
# if not _is_loopback(client_host):
# logger.warning(f"[auth] Rejecting X-Remote-User: client_host {client_host!r} is not loopback")
# raise AuthenticationException(
# message="X-Remote-User header is only trusted from the localhost proxy",
# status_code=401,
# headers={"WWW-Authenticate": "Bearer"},
# code=AuthErrorCode.INVALID_TOKEN,
# )
remote_user = request.headers.get("X-Remote-User")
if not remote_user:
raise AuthenticationException(
message="Missing X-Remote-User header from proxy",
status_code=401,
headers={"WWW-Authenticate": "Bearer"},
code=AuthErrorCode.INVALID_TOKEN,
)
return remote_user
--- uvicorn=0.29.0 proxy_headers=false ---
{
"token": "granted-to-duan_j",
"uvicorn": "0.29.0",
"proxy_headers_setting": "false",
"client_host": "127.0.0.1",
"is_loopback": true,
"x_remote_user": "duan_j",
}
--- uvicorn=0.29.0 proxy_headers=true ---
{
"error": "X-Remote-User only trusted from localhost proxy",
"uvicorn": "0.29.0",
"proxy_headers_setting": "true",
"client_host": "129.129.111.111",
"is_loopback": false,
"x_remote_user": "duan_j",
}
--- uvicorn=0.31.1 proxy_headers=false ---
{
"token": "granted-to-duan_j",
"uvicorn": "0.31.1",
"proxy_headers_setting": "false",
"client_host": "127.0.0.1",
"is_loopback": true,
"x_remote_user": "duan_j",
}
--- uvicorn=0.31.1 proxy_headers=true ---
{
"error": "X-Remote-User only trusted from localhost proxy",
"uvicorn": "0.31.1",
"proxy_headers_setting": "true",
"client_host": "129.129.111.111",
"is_loopback": false,
"x_remote_user": "duan_j",
}
[duan_j@mx-x06da-queue-01 venvs]$ aaredaq-pxii/bin/python -c "import uvicorn; print(uvicorn.version)"
0.34.2
[duan_j@mx-x06da-queue-01 venvs]$ aaredaq-pxii-with-common/bin/python -c "import uvicorn; print(uvicorn.version)"
0.34.2
[duan_j@mx-x06da-queue-01 venvs]$ aaredaq-pxiii/bin/python -c "import uvicorn; print(uvicorn.version)"
0.51.0
[duan_j@mx-x06da-queue-01 venvs]$ aaredaq-pxiii-with-common/bin/python -c "import uvicorn; print(uvicorn.version)"
0.51.0
Still no clue what is going on...