handle multiple values in X-Forwarded-Proto (#2162)

diff --git a/tornado/httpserver.py b/tornado/httpserver.py
index 8921a051fea216b3e574eec75d54cdb8ea089d76..da755f846f04cda570898419a7997392542d2e89 100644 (file)
--- a/tornado/httpserver.py
+++ b/tornado/httpserver.py
@@ -287,6 +287,10 @@ class _HTTPRequestContext(object):
         proto_header = headers.get(
             "X-Scheme", headers.get("X-Forwarded-Proto",
                                     self.protocol))
+        if proto_header:
+            # use only the last proto entry if there is more than one
+            # TODO: support trusting mutiple layers of proxied protocol
+            proto_header = proto_header.split(',')[-1].strip()
         if proto_header in ("http", "https"):
             self.protocol = proto_header
 

diff --git a/tornado/test/httpserver_test.py b/tornado/test/httpserver_test.py
index 2f9e9094a031f2a0fca88285798945a1fa16e666..1b1286022602ca5f8864a7acf0967d5d86d763c6 100644 (file)
--- a/tornado/test/httpserver_test.py
+++ b/tornado/test/httpserver_test.py
@@ -550,6 +550,16 @@ class XHeaderTest(HandlerBaseTestCase):
             self.fetch_json("/", headers=https_forwarded)["remote_protocol"],
             "https")
 
+        https_multi_forwarded = {"X-Forwarded-Proto": "https , http"}
+        self.assertEqual(
+            self.fetch_json("/", headers=https_multi_forwarded)["remote_protocol"],
+            "http")
+
+        http_multi_forwarded = {"X-Forwarded-Proto": "http,https"}
+        self.assertEqual(
+            self.fetch_json("/", headers=http_multi_forwarded)["remote_protocol"],
+            "https")
+
         bad_forwarded = {"X-Forwarded-Proto": "unknown"}
         self.assertEqual(
             self.fetch_json("/", headers=bad_forwarded)["remote_protocol"],