Access denied to reverse proxied domains from mobile device

Viewed 48

everyone! Hope you are doing well!

I really need help since I was fighting this issue for a long time.

I have a Nginx reverse proxy (nginx/1.20.1) for remote hosts. Basically I've got bunch of websites who restricted an access to their users based on countries.

So I just made a reverse proxy with following config:

         upstream somename443     { server some.domain.com:443; }

server {
    if ($host = some-name.proxied.org) {
        return 301 https://$host$request_uri;
    }
        server_name  some-domain.proxied.org;
        listen       111.11.1.111:80;
        access_log  /var/log/nginx/domain-proxied.access.log compression;
        error_log   /var/log/nginx/domain-proxied.error.log debug;
        location /.well-known {
            root /var/www/html/proxy;
        }
}


server {
        server_name  some-domain.proxied.org;
        listen       111.11.1.111:443 ssl http2;
        access_log   /var/log/nginx/domain-proxied.access.log compression;
        error_log    /var/log/nginx/domain-proxied.error.log  debug;
        location / {
            root /var/www/html/proxy;
            try_files $uri @static;
        }
        location @static {
                proxy_pass https://somename443;
                proxy_set_header Host   real.domain.com;
                proxy_ssl_server_name on;
                proxy_ssl_name real.domain.com;
                include './sites-available/location.conf.inc';
        }
    ssl_certificate /etc/letsencrypt/live/proxied.domain.org/fullchain.pem; 
    ssl_certificate_key /etc/letsencrypt/live/proxied.domain.org/privkey.pem;
         ssl_session_timeout 1d;
         ssl_stapling on;
         ssl_session_cache shared:SSL:50m;
         ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
         ssl_prefer_server_ciphers on;
         ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-A
}

location.conf.inc config:

                proxy_buffering on;
                proxy_request_buffering on;
                proxy_http_version 1.1;
                proxy_set_header Accept-Encoding "";
                proxy_connect_timeout 300s;
                proxy_send_timeout 300s;
                proxy_read_timeout 300s;
                proxy_buffer_size 16k;
                proxy_buffers 4 64k;
                proxy_max_temp_file_size 0;
                proxy_busy_buffers_size 128k;
                proxy_temp_file_write_size 128k;
                client_max_body_size 10m;
                client_body_buffer_size 128k;
                sub_filter_once off;
                sub_filter_types *;

        proxy_cookie_domain     'realdomain.com'                         'proxieddomain.org';
        proxy_cookie_domain     'realdomain.com'                         'proxieddomain.org';
        sub_filter              'realdomain.com'                         'proxieddomain.org';
        sub_filter              'realdomain.com'                        'proxieddomain.org';
        proxy_redirect          http://realdomain.com                    https://proxieddomain.com;
        proxy_cookie_domain     'realdomain.com'                         'proxieddomain.org';

and ...other many proxied domains...

And I gotta say that everything works perfectly well except for 1 domain (& 2 sub-domains) with mobile game launcher version:

I always get the same error when I open this game on my cell phone:

"**Access Denied**
You don't have permission to access "https://first-proxied-subdomain.org/mobile-game-launcher/GameLauncher" on this server.

Reference #numbers"

The above message happens every time when the traffic goes through proxy and when there is a POST request with following header:

Request URL: https://first-sub-domain.org/mobile-game-launcher/GameLauncher
Request Method: POST
Status Code: 403 
Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 08 Jul 2022 09:40:57 GMT
Expires: Fri, 08 Jul 2022 09:40:57 GMT
mime-version: 1.0
Server: nginx/1.20.1
Provisional headers are shown
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Origin: https://absolutely-another-proxied-domain.org
Referer: https://absolutely-another-proxied-domain.org/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Mobile/15E148 Safari/604.1
gameId: starburst_mobile_html_sw
disableDeviceDetection: false
showHomeButton: false
gameLocation: games/starburst_mobile_html/
preBuiltGameRulesSupported: true
server: https://second-sub-domain.org/
lang: en
sessid: 1657272794779-94881-NTFKQ9DI2I007
operatorId: default
gameURL: https://firs-sub-domain.org/games/game_mobile_html/game/game_mobile_html.xhtml

There are 2 sub-domains for proxied.domain.com:

first-proxied-subdomain.org & second-proxied-subdomain.org

All nginx configs for all of them are the same and it works as I said earlier for both desktop and mobile clients, but not for these 2 sub domains. First sub-domain gets/posts something to second sub-domain and the second does it back too for first one.

I have tried everything and I'm lost, please, help me if you can. Thanks a lot!

1 Answers

The error is private and not of a mass nature, it was fixed on the side of the proxied server. The topic is closed.

Related