Server's IP in URLs in cached templates

Question

I'm running Craft CMS 3.3.11 on an EC2 machine with Apache and Load Balancer.

After upgrading to Craft 3, I'm having issues with caching.

I use relative paths to resources/assets in my templates (i.e. href="/resources/logo.svg"

After some time, the relative paths in the template are not handled properly - instead of domain name in the URLs I get the server's IP address. It's impossible to fetch data using IP address, so the website is loading forever, the assets won't show up and it logs an error to the dev console:

Mixed Content: The page at ‘https://example.com/’ was loaded over HTTPS, but requested an insecure image ‘http://172.xx.xx.xx/cpresources/8f9c0f5e/logo.svg?v=1572966078’. This content should also be served over HTTPS.

When I clear caches, everything works properly again.

Adding {{ siteUrl }} before all the relative paths seems to be the easiest fix, but I wonder if maybe I have some configuration issues that should be fixed to prevent this in future?

Server's IP isn't stored neither in the database nor the template files - where does it come from?

Suggestions?

EDIT

Unfortunately it still doesn't work properly.

Here's my code:

                    <img src="{{ craft.rebrand.getLogo().url }}" alt="{{ siteName }}"
                         class="brand-logo">
                {% endif %}


                {% if craft.rebrand.isIconUploaded() %}
                    <img src="{{ craft.rebrand.getIcon().url }}" alt="{{ siteName }}"
                         class="brand-icon">
                {% endif %}

For these assets Craft is using server's IP... Can someone please advise?

Answer 1

These are probably coming from the incoming request in the $_SERVER PHP superglobal

Yii2 does its best to figure out the incoming request, but that's relying on information coming from the client, which is insecure. Note the warning about potential cache poisoning in the Craft CMS docs:

Don’t ever use the @web alias when defining your sites’ Base URLs. It could introduce a cache poisoning vulnerability, and Craft won’t be able to reliably determine which site is being requested.

This is for the same reason; if no explicit siteUrl is provided, it'll try to figure it out from the request.

In your case, craft.rebrand.getLogo().url ends up calling getImageVariable which then ends up calling the Yii2 asset manager to get the published URL. I think your siteUrl or other aliases may not be set properly.

    /**
     * Returns the schema and host part of the current request URL.
     *
     * The returned URL does not have an ending slash.
     *
     * By default this value is based on the user request information. This method will
     * return the value of `$_SERVER['HTTP_HOST']` if it is available or `$_SERVER['SERVER_NAME']` if not.
     * You may want to check out the [PHP documentation](https://secure.php.net/manual/en/reserved.variables.server.php)
     * for more information on these variables.
     *
     * You may explicitly specify it by setting the [[setHostInfo()|hostInfo]] property.
     *
     * > Warning: Dependent on the server configuration this information may not be
     * > reliable and [may be faked by the user sending the HTTP request](https://www.acunetix.com/vulnerabilities/web/host-header-attack).
     * > If the webserver is configured to serve the same site independent of the value of
     * > the `Host` header, this value is not reliable. In such situations you should either
     * > fix your webserver configuration or explicitly set the value by setting the [[setHostInfo()|hostInfo]] property.
     * > If you don't have access to the server configuration, you can setup [[\yii\filters\HostControl]] filter at
     * > application level in order to protect against such kind of attack.
     *
     * @property string|null schema and hostname part (with port number if needed) of the request URL
     * (e.g. `http://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set.
     * See [[getHostInfo()]] for security related notes on this property.
     * @return string|null schema and hostname part (with port number if needed) of the request URL
     * (e.g. `http://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set.
     * @see setHostInfo()
     */
    public function getHostInfo()
    {
        if ($this->_hostInfo === null) {
            $secure = $this->getIsSecureConnection();
            $http = $secure ? 'https' : 'http';

            if ($this->headers->has('X-Forwarded-Host')) {
                $this->_hostInfo = $http . '://' . trim(explode(',', $this->headers->get('X-Forwarded-Host'))[0]);
            } elseif ($this->headers->has('Host')) {
                $this->_hostInfo = $http . '://' . $this->headers->get('Host');
            } elseif (isset($_SERVER['SERVER_NAME'])) {
                $this->_hostInfo = $http . '://' . $_SERVER['SERVER_NAME'];
                $port = $secure ? $this->getSecurePort() : $this->getPort();
                if (($port !== 80 && !$secure) || ($port !== 443 && $secure)) {
                    $this->_hostInfo .= ':' . $port;
                }
            }
        }

        return $this->_hostInfo;
    }