Define a proxy for Nginx

Server NGINX
#1

Hello,

My Nginx servers are behind a proxy. Some PHP apps need to reach
external
web sites (for RSS feeds for example). I’ve tried this in nginx.conf :

env http_proxy=http://myproxy:port

but there is no effect.

How can I define a proxy for nginx ?

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,244407,244407#msg-244407

#2

On 4 November 2013 13:00, odesport [email protected] wrote:

Hello,

My Nginx servers are behind a proxy. Some PHP apps need to reach external
web sites (for RSS feeds for example). I’ve tried this in nginx.conf :

env http_proxy=http://myproxy:port

but there is no effect.

How can I define a proxy for nginx ?

I don’t know the answer to that specific question, but I believe
you’re asking the /wrong/ question :slight_smile:

Nginx doesn’t execute your PHP, it just passes the requests to another
process. Your PHP apps will be executing in the context of this
different process (such as php-fpm) and it is /that/ process which you
need to inform about an outbound HTTP proxy. The specifics of how you
do that will depend on which process you’ve chosen to contain your
PHP, and the way in which your PHP makes outbound HTTP calls.

HTH,
Jonathan

Jonathan M.
Oxford, London, UK
http://www.jpluscplusm.com/contact.html

#3

I can’t modify PHP code. I’ve managed to do this for Apache by adding
the
line

export http_proxy=“http://myproxy:port”

in /etc/apache2/envvars

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,244407,244410#msg-244410

#4

On 4 November 2013 14:09, odesport [email protected] wrote:

I can’t modify PHP code. I’ve managed to do this for Apache by adding the
line

export http_proxy=“http://myproxy:port”

in /etc/apache2/envvars

Glad to hear you’ve solved your problem :slight_smile:

J

#5

Assuming you’re using php-fpm or php-cgi you can set a param to pass
that
as a server variable:

fastcgi_param HTTP_PROXY ‘http://proxy:myport’;

Then you’ll have a $_SERVER[‘HTTP_PROXY’] entry for the global $_SERVER.

HTH,

----appa

#6

Thanks, but with fastcgi_param I have to modify PHP code.

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,244407,244462#msg-244462

#7

No you don’t. It’s a server config. It will set the same global as the
Apache env thing AFAIK.

----appa

#8

On 5 November 2013 15:25, António P. P. Almeida [email protected]
wrote:

Assuming you’re using php-fpm or php-cgi you can set a param to pass that as
a server variable:

fastcgi_param HTTP_PROXY ‘http://proxy:myport’;

Then you’ll have a $_SERVER[‘HTTP_PROXY’] entry for the global $_SERVER.

I don’t think this is right, for a couple of reasons.

Firstly, some reading has suggested that there isn’t a way to force
the stock PHP HTTP request libraries to use a proxy just by setting an
envvar. Witness, for instance, the code-level changes that are
(/were?) required to get a relatively mainstream piece of s/w like WP
to work with an outbound proxy:
http://wpengineer.com/1227/wordpress-proxysupport/

Secondly, the specific string mentioned would (unless I’m missing
something, which is very possible!) open a security hole: $SERVER
contains all user-specified HTTP request headers with added "HTTP"
prefixes. The method suggested, if it worked, would mean that, as a
user, I could simply provide a “Proxy: my.proxy.server.ip” header and
get all outbound HTTP traffic (for my request) proxied via my
external server. Thereby exposing internal information such as 3rd
party API passwords, internal HTTP API call details, etc etc.

Again, I may be missing something with either of these points but,
obviously, I don’t see what it might be! :slight_smile:

Regards,
Jonathan

#9

As for the first point, of course that variable needs to be used on the
application side.
The OP suggested that is cased since he described basically that with
the
Apache env var
directive.

As for the second, I was not considering security issues, but:

  1. You need to be able to edit the php-fpm configuration.

  2. You need to do a reload for the config to take effect.

In a properly setup Nginx both of these require root access.

Yes it’s hardly the best way to do things. But then it works and it
isn’t
either the worst.

Note that it’s not a header at all, but a parameter passed through the
FCGI
daemon on each
request.

----appa

On Wed, Nov 6, 2013 at 10:24 AM, Jonathan M.