Blog post navigation issue

[ramdev1980]

Describe the bug
The blog posts have an issue: The “Newer Entries” and “Older Entries” links on any post doesn't work, they connect back to the blog page you’re on.

To Reproduce
Steps to reproduce the behavior:

1. Create blogs list
2. Create blog posts at least 3
3. In blog post set the "Location of blog navigation" as "Beneath blog post"
4. Try to navigate between blog post using “Newer Entries” and “Older Entries” links
5. It doesn't work.

Expected behavior
“Newer Entries” and “Older Entries” links should work.

[natechadwick]

@ramdev1980 You have to publish the blog posts and have a running DTS for this as well right? Also didn't you have to edit the perc-security.properties files to stop the CORS error?

[natechadwick]

I am moving this to a discussion because I think it is a configuration issue. In a reverse proxy setup with IIS where IIS is configured for HTTPS, the proxy must also use https to connect to the DTS. This means that the DTS needs to have a valid hostname and a valid https certificate configured.

[natechadwick]

The issue is related to the latest browser / server security settings. When in a reverse proxy configuration, the full flow must now be configured over https with valid public SSL certificates (self-signed certificates will not work).

Here are a couple examples of invalid configurations:

❌ Web Server Proxying to DTS Over HTTP

flowchart TD;
     t1(User Browser - https://www.mysite.com:443) --> t2( IIS Web Server - https://www.mysite.com:443) --> t3(DTS Tomcat - http://serverip:9980);

Loading

❌ Web Server Proxying to DTS Over HTTPS but not with valid certificate

flowchart TD;
     t1(User Browser - https://www.mysite.com:443) --> t2( IIS Web Server - https://www.mysite.com:443) --> t3(DTS Tomcat - https://serverip:8443);

Loading

✅Web Server Proxying to DTS Over HTTPS with valid certificate

flowchart TD;
     t1(User Browser - https://www.mysite.com:443) --> t2( IIS Web Server - https://www.mysite.com:443) --> t3(DTS Tomcat - https://dts.mysite.com:8443);

Loading

Steps to configure

1. Pick a hostname for the DTS server and register it in DNS. If DTS is local to the web server this could be added as an alias to 127.0.0.1 in the system hosts file (Windows\System32\drivers\etc on Windows /etc/hosts on Linux / OSX.
2. Get a valid certificate with that hostname as a subject on the certificate, or use a wildcard certificate.
3. Add the certificate to a Java keystore and place it in the Deployment\Server\conf folder.
4. Update the Deployment\Server\conf\perc\perc-catalina.properties file and change the keystoreFile property to point at conf/yournewkeystorefile, also update the keystoreAlias and password. Leave keystorePassword blank if you didn't set a password.
5. Verify your CORS configuration in Deployment\Server\conf\perc\perc-security.properties. The accessControlAllowedOrigins property should be a comma delimited list of hosts that are allowed to call the DTS services. In the example above this should be at least accessControlAllowedOrigins = https://www.mysite.com,http://localhost:9980, https://localhost:8443. Note that * no longer works.
6. Stop and start the DTS.
7. Review the IIS / Apache proxy URL Rewrite rules. Make sure that they are using https://dts.mysite.com:8443/ to connect to the DTS service.