307 Temporary Redirect On Specific Routes

[Sepehrworklife]

I have an API service that I wrote with FastApi and served with gunicorn. Apache is working on the server as a reverse proxy and SSL manager.
Everything was fine until I decided to use SqlAdmin as the admin panel.
The problem is that my API endpoints work fine with SSL but SqlAdmin endpoints are not.
e.g: Responses I get when I want to reach https://example.com/admin: (FAIL)

--- I summarized responses ---
307 Temporary Redirect -> http://example.com/admin
302 Not Found
Somehow redirect -> https://example.comadmin/

e.g: Responses I get when I want to reach https://example.com/users: (PASS) (API ENDPOINT)

Request URL: https://example.com/users/
Request Method: GET
Status Code: 200 OK

Apache Configuration:

<VirtualHost ip:80>
 ServerName subdomain.example.com
ServerAlias www.subdomain.example.com
 ServerAdmin ****@gmail.com
Redirect / https://subdomain.example.com
</VirtualHost>
<VirtualHost ip:443>
 ServerName subdomain.example.com
ServerAlias www.subdomain.example.com
 ServerAdmin ******@gmail.com
ProxyRequests On
ProxyPreserveHost On
<Proxy *>
    Order deny,allow
    Allow from all
</Proxy>
SSLEngine on
SSLCertificateFile *****
ProxyPass / http://example.com:8000/
ProxyPassReverse / http://example.com:8000/
<Location />
    Order allow,deny
    Allow from all
</Location>
</VirtualHost>

Gunicorn Configuration:

import json
import multiprocessing
import os

workers_per_core_str = os.getenv("WORKERS_PER_CORE", "1")
max_workers_str = os.getenv("MAX_WORKERS")
use_max_workers = None
if max_workers_str:
    use_max_workers = int(max_workers_str)
web_concurrency_str = os.getenv("WEB_CONCURRENCY", None)

host = os.getenv("HOST", "0.0.0.0")
port = os.getenv("PORT", "80")
bind_env = os.getenv("BIND", None)
use_loglevel = os.getenv("LOG_LEVEL", "warning")
if bind_env:
    use_bind = bind_env
else:
    use_bind = f"{host}:{port}"

cores = multiprocessing.cpu_count()
workers_per_core = float(workers_per_core_str)
default_web_concurrency = workers_per_core * cores
if web_concurrency_str:
    web_concurrency = int(web_concurrency_str)
    assert web_concurrency > 0
else:
    web_concurrency = max(int(default_web_concurrency), 2)
    if use_max_workers:
        web_concurrency = min(web_concurrency, use_max_workers)
accesslog_var = os.getenv("ACCESS_LOG", "/var/log/gunicorn/access_log")
use_accesslog = accesslog_var or "/var/log/gunicorn/access_log"
errorlog_var = os.getenv("ERROR_LOG", "/var/log/gunicorn/error_log")
use_errorlog = errorlog_var or "/var/log/gunicorn/error_log"
graceful_timeout_str = os.getenv("GRACEFUL_TIMEOUT", "120")
timeout_str = os.getenv("TIMEOUT", "120")
keepalive_str = os.getenv("KEEP_ALIVE", "5")

# Gunicorn config variables
loglevel = use_loglevel
workers = web_concurrency
bind = use_bind
errorlog = use_errorlog
worker_tmp_dir = "/dev/shm"
accesslog = use_accesslog
graceful_timeout = int(graceful_timeout_str)
timeout = int(timeout_str)
keepalive = int(keepalive_str)


# For debugging and testing
log_data = {
    "loglevel": loglevel,
    "workers": workers,
    "bind": bind,
    "graceful_timeout": graceful_timeout,
    "timeout": timeout,
    "keepalive": keepalive,
    "errorlog": errorlog,
    "accesslog": accesslog,
    # Additional, non-gunicorn variables
    "workers_per_core": workers_per_core,
    "use_max_workers": use_max_workers,
    "host": host,
    "port": port,
}
print(json.dumps(log_data))

I don't have any idea how this behavior happened at all so any clue would be helpful :)
Thanks in advance.

1. I did try to add middleware to the FastApi. HTTPSResponseMiddleware.
   every request reached to this response on gunicorn:
   WARNING: Invalid HTTP request received.
2. I did try to start gunicorn with --forwarded-allow-ips='*' and --proxy-headers.
   Nothing changed.

[iagobalmeida]

Hey there! I've had some problems with HTTPS and need to override the url_for() function of the Admin.templates templating engine.
The code basically changes HTTP to HTTPs on the URLs when you are in a HTTPs request.

import jinja2

@jinja2.pass_context  # noqa
def url_for(context: dict, name: str, **path_params: Any) -> str:
    request = context["request"]
    http_url = request.url_for(name, **path_params)
    if request.url.scheme == 'https' or "x-forwarded-for" in request.headers.keys():
        return str(http_url).replace("http", "https", 1)
    else:
        return http_url
        
 class HTTPSAdmin(Admin):

    def init_templating_engine(self) -> Jinja2Templates:
        templates = super().init_templating_engine()
        templates.env.globals["url_for"] = url_for
        return templates

[aminalaee]

I think (most probably) you don't need to change the code if you setup the reverse proxy (Nginx, etc) and Uvicorn + Gunicorn correctly.
I have the demo running over HTTPS too: https://sqladmin-demo.aminalaee.dev/admin/

[s1beria21]

Do you use ssl certificates at uvicorn?

[aminalaee]

No, why should Gunicorn or Uvicorn handle your certificates? Can't the revrse proxy do this?

[s1beria21]

You are right. But when i run uvicorn behind nginx(ssl), response with static files has http (not https).

[aminalaee]

Have you tried these ? https://aminalaee.dev/sqladmin/faq/
--forwarded-allow-ips=*

[s1beria21]

yes. I describe my situation in comment below.

[s1beria21]

i have same problem. i have nginx as reverse proxy (ssl), but without gunicorn, only uvicron. the first problem was not loading static files on any sqladmin pages. When i open any sqladmin pages i receive admin static files over http and browser blocked this response. i added --forwarded-allow-ips='*' and --proxy-headers - don`t solved this problem. Adding HTTPSResponseMiddleware raise 307 temporary redirect. Serfing stackoverflow i found how to add js (not css). Add to head scope in html

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Looks like strange...
As a temporary decision devops create nginx reverse proxy dublicate (no ssl) for my admin panel. I think there is only one approach to solve this problem. Start uvicorn with certificates.