App on Heroku Redirects to Root-url on Custom Domain

mikroklima · November 10, 2020, 7:35pm

Hi,

I have a meteor app that mysteriously redirects to the registered root url, when a new custom domain is loaded. This happens only with custom domains… Please note that it is the root url that it’s redirected to, not the …herokuapp.com url…

What could be the reason?

I can verify that the reason was not at the DNS level, nor at any Heroku configuration. Thus do I have the conclusion that it is Meteor specific. It redirects before any application code I wrote is even rendered…

mikroklima · November 10, 2020, 7:39pm

OK, interesting to find out that the reason behind was that the root url was configured with an .app tld. When I changed it to another, it worked like a blaze.

I have also previously encountered issues with .app domain that acted strangely. It most definitely has to do with the SSL requirements etc…

robfallows · November 10, 2020, 8:10pm

.app (and .dev) TLDs are owned by Google and HTTPS is enforced. Having said that, I don’t quite understand the behaviour you’ve described .

mikroklima · November 20, 2020, 9:03pm

I’m back at this point again. There’s again the same issue with another url assigned to the application via Heroku’s CP.

This time, regardless of the root url being .com or .app or so; another domain that I need to assign which has .org tld gets redirected to the root url…

Any ideas why and how to prevent that?

mikroklima · November 26, 2020, 9:42pm

So I found the root of the problem, but couldn’t yet find an easy solution. But close!

The root problem is due to the force-ssl package that I’m using to force the connection to use SSL. It works well. However, the code within the package actually redirects somehow non-https connections to https but always to the assigned Meteor root url… But it would be nice with another method because, I’m guessing, many people including me use additional custom urls to run one app, and so it becomes daunting to redirect to an irrelevant url…

Any suggestions? A new PR to the force-ssl package?? @robfallows?

mikroklima · November 26, 2020, 9:48pm

github.com

meteor/meteor/blob/master/packages/force-ssl/force_ssl_server.js#L26


// (either by us or by a proxy) OR the connection is entirely over
// localhost (development mode).
//
// Note: someone could trick us into serving over non-ssl by setting
// x-forwarded-for, x-forwarded-proto, forwarded, etc. Not much we can do
// there if we still want to operate behind proxies.
if (!isLocalConnection(req) && !isSslConnection(req)) {
  // connection is not cool. send a 302 redirect!
  var host = url.parse(Meteor.absoluteUrl()).hostname;
  // strip off the port number. If we went to a URL with a custom
  // port, we don't know what the custom SSL port is anyway.
  host = host.replace(/:\d+$/, '');
  res.writeHead(302, {
    'Location': 'https://' + host + req.url,
    'Access-Control-Allow-Origin': '*'
  });
  res.end();

mikroklima · November 26, 2020, 9:49pm

In my server code within methods etc, I use this code to figure out the host:

const host = this.connection.httpHeaders.host

Could this work well also perhaps?