Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Fail to create cookies while using ngrok with header rewrite

I use docker as my local dev environment and use the dinghy-http-proxy which adds a new TLD .docker to map request to a nginx-proxy container.

My websites are typically reached through an URL like http://devel.domain.com.docker.

I want to use ngrok to develop locally while accessing remote webhooks.

I successfully launched ngrok with the command:

ngrok http -host-header=rewrite devel.domain.com.docker 80

I can access the login form of my web application through the address http://randomsubdomain.ngrok.io.

However, I can't log in because it looks like the cookie session can't be set.

Indeed, cookies sessions are tried to be set for the domain devel.domain.com.docker but as we use randomsubdomain.ngrok.io in the browser they are blocked for security reasons.

How can I bypass this problem? Am I missing something in my configuration? Is ngrok the right tool for what I want to achieve?

like image 860
mperrin Avatar asked Jan 07 '17 16:01

mperrin


People also ask

Why Ngrok is not working?

Have you tried following a tutorial that uses Ngrok and could not make it work? The reason is likely that Ngrok has recently added some restrictions to its service, making the instructions that you find in a lot of tutorials incorrect for current versions of the tool.

How do you authenticate Ngrok?

The ngrok agent connects to the ngrok cloud and authenticates using the authtoken that is created when you sign up for ngrok. You can find the authtoken in the ngrok Dashboard. This command will create a configuration file at the default location for your system.

How can I change my Ngrok URL?

Add your domain name to your ngrok account We currently call this process "reservation" and you can do it from the domains page of your ngrok dashboard. Click "New Domain" and then put foo.example.com into the form that appears to add that domain to your account.


1 Answers

Asked directly to ngrok.io support and got this answer:

No, you're not missing anything, that's just an unfortunate side effect of rewriting the host header. Host header rewriting only works for some applications because of complications like this (and others that involve javascript and cross-origin, etc). If possible, it's always much better to reconfigure your website to accept the ngrok.io host header.

However, I found a solution by checking if the request contains in the header x-original-host the domain ngrok.io, and then I alter the session mechanism (in PHP session_set_cookie_params) to use the x-original-host domain instead.

like image 155
mperrin Avatar answered Oct 18 '22 19:10

mperrin