Feature request: forward proxy implementation

[FabianZihlmann]

Dear all

Thanks a lot for your work. I run my own server and it works like a charme.
In our production environment we have several security zones. So I'd like to run the server in a higher security zone. So I found out, that the server needs direct access to the internet.

If there is a forward proxy in beetween, I get the following error:
Error requesting remote jwks: error sending request for url (https://oauth.accounts.firefox.com/v1/jwks)

I didn't found any information about "how to set a forward proxy" in the configuration options.
Is there a possibility to implement such a feature?

Thanks a lot in advance!
Best regards
Fabian

┆Issue is synchronized with this Jira Task

[FabianZihlmann]

solved with pull request #1966

[taddes]

Hello @FabianZihlmann ! Thanks for your kind regards and also providing the pull request. Much of us are out due to the holiday break, so we will review and get back to you next week. The change looks simple enough, we just to evaluate the implications and see if there's any required testing. Thank you!

[FabianZihlmann]

Hello taddes
Thanks a lot for your comment. No hurry up, everything's fine.
It might be a good idea to improve the patch with some debugging information, in case the proxy is not well configured. I'm not experienced with rust so maybe someone else could care about.
For me it's just perfect, we can operate the syncstorage server in our security environment. Direct access to internet is a no go for any services expect proxy servers ... ;-)
Best regards and happy landing in the new year
Fabian

[chenba]

@FabianZihlmann what do you think of setting up the proxy to proxy all the requests to SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL / tokenserver.fxa_oauth_server_url through to the actual destination? e.g. token server -> http://localproxy/v1/jwks -> https://oauth.accounts.firefox.com/v1/jwks. Then you can set the env var or toml value of SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL / tokenserver.fxa_oauth_server_url without having to patch the service. Is there some advantage to proxying a single url?

[FabianZihlmann]

Dear chenba
That doesn't make any sense to our environment. It's just normal to have a general proxy service used in datacenters. So very often you don't have to adjust the proxy configuration, especially you have root server from a hosting provider.
Using proxy services is just common sense (from our point of view).

[chenba]

Ah sorry, @FabianZihlmann, I misunderstood the description of this issue. I took a quick look at your PR and it made sense to me. 👍