Apache: set X-Forwarded-Proto header

[manics]

This should ensure JupyterHub correctly compares the protocol used for the request (e.g. https) with the protocol from the referrer when checking for cross-site requests in the admin pages.

Closes #3780

@rzo1 @tobi45 would you mind checking this matches your configuration?

Preview of the rendered docs is at https://jupyterhub--3808.org.readthedocs.build/en/3808/reference/config-proxy.html#apache

[rzo1]

This matches our current configuration - so should work fine.

However, I would suggest to update the SSL/TLS configuration (to a more modern config) in an other PR.

[tobi45]

Can confirm that adding that line solves #3780.

WebSocket-Config and Proxy-Configuration matches my apache config.

[consideRatio]

I would suggest to update the SSL/TLS configuration (to a more modern config)

@rzo1 are you referring to this section?

  # configure SSL
  SSLEngine on
  SSLCertificateFile /etc/letsencrypt/live/HUB.DOMAIN.TLD/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/HUB.DOMAIN.TLD/privkey.pem
  SSLProtocol All -SSLv2 -SSLv3
  SSLOpenSSLConfCmd DHParameters /etc/ssl/certs/dhparam.pem
  SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

I think indeed that would be important to keep updated, preferably with a comment next to it saying that it may needs to be updated over time and perhaps also with a link to some helpful resource on how to do it?

I've never worked with Apache and won't try this myself. If you want, please open a PR! For reference, this is some related configuration I did of a proxy server accepting HTTPS traffic: https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/38c694b3c9a0a53f846379fd418a4a718eb073b7/jupyterhub/templates/proxy/autohttps/_configmap-dynamic.yaml#L89-L108

[rzo1]

@rzo1 are you referring to this section?

Yes. A good reference is offered by Mozilla: https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.1.1d&guideline=5.6

We could link it in the documentation (or in a comment). I can provide a PR after this one is merged.