Redirect loop on any url with https in Symfony2

Question

Wherever I try to implement the https channel, there will be an infinite redirect loop. This is what the security.yml file looks like:

security:
    encoders:
        FOS\UserBundle\Model\UserInterface: sha512

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    providers:
        fos_userbundle:
            id: fos_user.user_provider.username

    firewalls:
        main:
            pattern: .*
            form_login:
                provider: fos_userbundle
                csrf_provider: form.csrf_provider
                check_path: /login_check
                login_path: /login
                default_target_path:  /home
            logout:
                path:   /logout
                target: /index
            security: true
            anonymous: true
            remember_me:
                key:      mySecret
                lifetime: 604800 #seven days
                path:     /
                domain:   ~

    access_control:
        - { path: ^/js, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/css, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/_wdt, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/_profiler, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/index*, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/admin/.*, role: ROLE_ADMIN }
        - { path: ^/.*, roles: ROLE_USER }

For example if I change the admin path to:

- { path: ^/admin/.*, role: ROLE_ADMIN, requires_channel: https }

the loop will occur. Also in the routing/entity.yml I tried something like this:

entity_index:
  pattern: /
  defaults: { _controller: MyBundle:Entity:index }
  schemes: [https]

Anybody has an idea how to solve this?

Answer 1

I had the same problem because the server was sitting behind a reverse proxy, which commmunicated over ssl with the client, but http with the server the application was running on. I only used this, because the connection between RP and App Server is secure since it doesn't leave the internal network. if you're really positive you really have SSL running and this problem occurs, there's one ugly fix for that... But it's really last resort and to use on your own risk:

you can overwrite the server vars in your app.php like this:

$_SERVER['HTTPS'] = 'on'; 
$_SERVER['SERVER_PORT'] = 443;

again, this is an ugly fix, not a solution, only use at your only risks and responsibilty, I wouldn't do this if I didn't have the problem with my reverse proxy not forwarding the port and wasn't 100% sure I had SSL between client and RP. Don't forget, this makes you vulnerable if you're not really running valid ssl