github Oauth redirection url in case of Google Cloud Run includes subdirectory name

[AmritasyaPutra]

I moved my six year old website and was integrating remark42. First I integrated with docker running on the ubuntu webhost directly and everything worked as expected. I was able to validate github and google oauth. Then I moved remark42 to google cloud run. Anonymous commenting is working. github login also works but with a caveat: when I try to login with github I am redirected to https://github.com/DB7B84/login/oauth/authorize?client_id=...

DB7B84 is the sub-directory under which I am proxying the remark42 instance. If I delete the "DB7B84" from the URL and refresh the page then things work and I am logged in. To workaround I put varnish in front of the response chain and put the following rule, so that it works now.

        # Jyoti: Fix lighttpd reverseproxy problem with remark42 Oauth with github
        if ((beresp.status == 302 || beresp.status == 303) && beresp.http.Location ~ "/DB7B84/login/oauth/authorize") {
                set beresp.http.Location = regsub(beresp.http.Location, "/DB7B84/", "/");
        }

For now, I have reverted the varnish rule so that the problem can be observed on https://podcast.ekvastra.in/comments I don't mind keeping it like that for a few weeks so that this can be looked at.

I am very impressed with remark42 and really appreciate the hard work behind it.

[AmritasyaPutra]

... when I looked at my own comment in the vcl code above I think the problem is with lighttpd reverse proxy rather than remark42. I will explore that angle. Any comment is welcome.

[umputun]

moved to discussions

[paskal]

I am 95% sure it's an issue on the side of your HTTP server. Please see this doc and let me know if something is missing there. With lighttpd configuration should look something like that:

# Proxy Remark42 without a subdomain
$HTTP["url"] =~ "^/remark42/" {
    url.rewrite = ( "^/remark42/(.*)" => "/$1" )
    
    proxy.server = (
        "" => (
            ( "host" => "remark42", "port" => 8080 )
        )
    )

    setenv.add-request-header = (
        "Host" => "env.HTTP_HOST",
        "X-Real-IP" => "env.REMOTE_ADDR",
        "X-Forwarded-For" => "env.REMOTE_ADDR",
        "X-Forwarded-Proto" => "https"
    )
}

[AmritasyaPutra]

Yes, the quirk was with lighttpd. url.rewrite does not behave as expected inside a $HTTP["url"] block, instead I had the following:

proxy.forwarded = ( "for" => 1, "proto" => 1 )
proxy.header = ( "map-urlpath" => ( "/DB7B84/" => "/" ) )

The problem is that it does substitution on the way-back also, meaning that / in the "Location" of a 302 or 303 HTTP was updated to /DB7B84/ due to the above proxy.header rule. But all that I needed (and what you have suggested) is the one way rewrite.

To confirm this I moved the proxy handling entirely to the frontend varnish server as follows, where I have the equivalent of url.rewrite instead of proxy.header functionality of lighttpd:

        # Jyoti: Use google cloud run backend which hosts remark42 instance for podcast.ekvastra.in
        if (req.http.host == "podcast.ekvastra.in" && req.url ~ "^/DB7B84/") {
                set req.backend_hint = remark42_podcast_google_clound_run_backend;
                set req.url = regsub(req.url, "^/DB7B84/","/");
                set req.http.host = "remark42-secret-string.run.app";
        } else {
                set req.backend_hint = default_lighttpd;
        }

Github login is working as expected now. Thank you @umputun and @paskal .