# Https Frontend to Http backend 400 (BAD REQUEST)

**URL:** <https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234>\
**Category:** Help!\
**Created:** [May 15, 2020, 4:00am UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234 "2020-05-15T04:00:04Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexander90](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Alexander90](https://discourse.haproxy.org/u/Alexander90)\
**Post date:** [May 15, 2020, 4:00am UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/1 "2020-05-15T04:00:04Z")

</div>

Hello I have a https / http frontend which accesses an http backend.  
Basically I want to limit the frontent to https. The problem, however, is that the web service repeatedly generates a POST 400 (BAD REQUEST) error when called up via https when I open the page via my web browser.

Here is my configuration:

```
global
	maxconn 5000
	log /var/run/log	local0	debug
	stats socket /tmp/haproxy.socket level admin expose-fd listeners
	uid 80
	gid 80
	nbproc 1
	nbthread 1
	hard-stop-after 15m
	chroot /tmp/haproxy_chroot
	daemon
	tune.ssl.default-dh-param	2048
	server-state-file /tmp/haproxy_server_state
	

listen HAProxyLocalStats
	bind 127.0.0.1:2200 name localstats
	mode http
	stats enable
	stats admin if TRUE
	stats show-legends
	stats uri /haproxy/haproxy_stats.php?haproxystats=1
	timeout client 5000
	timeout connect 5000
	timeout server 5000

frontend NachOpenVPN_HTTPS-aus_LAN
	bind 10.4.4.239:443 name 10.4.4.239:443 no-sslv3 ssl crt-list /var/etc/haproxy/NachOpenVPN_HTTPS-aus_LAN.crt_list
	bind 10.4.4.239:80 name 10.4.4.239:80	
	mode http
	log global
	option socket-stats
	option log-separate-errors
	option httplog
	option http-keep-alive
	option forwardfor
	acl https ssl_fc
	http-request set-header X-Forwarded-Proto http if !https
	http-request set-header X-Forwarded-Proto https if https
	timeout client 7200000
	acl DL_thorstenACL	var(txn.txnhost) -m str -i vpn.schulte-batenXXX.de
	http-request set-var(txn.txnhost) hdr(host)
	use_backend DLthorsten-ohne-passwort_ipvANY if DL_thorstenACL aclcrt_NachOpenVPN_HTTPS-aus_LAN

backend DLthorsten-ohne-passwort_ipvANY
	mode http
	id 106
	log global
	stick-table type ip size 50k expire 30m
	stick on src
	timeout connect 30000
	timeout server 30000
	retries 3
	server DL_Thorsten 10.4.4.10:1731 id 111

```

Log from haproxy:

```
May 15 05:54:47 haproxy[92018]: 10.4.4.241:62950 [15/May/2020:05:54:47.424] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/0/5/5 400 130 - - ---- 6/6/5/5/0 0/0 "POST /socket.io/?EIO=3&transport=polling&t=N8MU63L&sid=ec5b759b878a4dfcac0b96b29893255b HTTP/1.1"
May 15 05:54:47 haproxy[92018]: 10.4.4.241:62881 [15/May/2020:05:54:17.061] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/0/-1/30027 504 218 - - sH-- 6/6/5/5/0 0/0 "GET /socket.io/?EIO=3&transport=polling&t=N8MT-fV&sid=2fc24b8c6e3d4a2d8ac1850799d3b1b7 HTTP/1.1"
May 15 05:54:46 haproxy[92018]: 10.4.4.241:62939 [15/May/2020:05:54:46.763] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/0/5/5 400 130 - - ---- 6/6/5/5/0 0/0 "POST /socket.io/?EIO=3&transport=polling&t=N8MU5va&sid=ec5b759b878a4dfcac0b96b29893255b HTTP/1.1"
May 15 05:54:46 haproxy[92018]: 10.4.4.241:62948 [15/May/2020:05:54:46.652] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/1/5/8 101 138 - - ---- 7/7/5/5/0 0/0 "GET /socket.io/?EIO=3&transport=websocket&sid=ec5b759b878a4dfcac0b96b29893255b HTTP/1.1"
May 15 05:54:46 haproxy[92018]: 10.4.4.241:62939 [15/May/2020:05:54:44.220] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/0/2242/2245 200 59965 - - ---- 6/6/5/5/0 0/0 "GET /socket.io/?EIO=3&transport=polling&t=N8MU3d3 HTTP/1.1"
May 15 05:54:44 haproxy[92018]: 10.4.4.241:62939 [15/May/2020:05:54:44.205] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/1/7/8 400 130 - - ---- 6/6/5/5/0 0/0 "POST /socket.io/?EIO=3&transport=polling&t=N8MU37u&sid=7fe4c58f5d7a4297a1f9ca307c0eef55 HTTP/1.1"
May 15 05:54:44 haproxy[92018]: 10.4.4.241:62868 [15/May/2020:05:54:14.142] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/0/-1/30028 504 218 - - sH-- 6/6/5/5/0 0/0 "GET /socket.io/?EIO=3&transport=polling&t=N8MTzxt&sid=0c793cecac2245c3b28d6ee7901c2f7f HTTP/1.1"
May 15 05:54:35 haproxy[92018]: 10.4.4.241:62921 [15/May/2020:05:54:34.965] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/0/4/44 400 130 - - ---- 6/6/5/5/0 0/0 "POST /socket.io/?EIO=3&transport=polling&t=N8MU31C&sid=7fe4c58f5d7a4297a1f9ca307c0eef55 HTTP/1.1"
May 15 05:54:34 haproxy[92018]: 10.4.4.241:62923 [15/May/2020:05:54:34.930] NachOpenVPN_HTTPS-aus_LAN~ DLthorsten-ohne-passwort_ipvANY/DL_Thorsten 0/0/1/6/8 101 138 - - ---- 7/7/5/5/0 0/0 "GET /socket.io/?EIO=3&transport=websocket&sid=7fe4c58f5d7a4297a1f9ca307c0eef55 HTTP/1.1"

```

haproxy -vv

```
[2.4.4-RELEASE][root@pfSense.localdomain]/root: haproxy -vv
HA-Proxy version 2.0.14 2020/04/02 - https://haproxy.org/
Build options :
  TARGET = freebsd
  CPU = generic
  CC = cc
  CFLAGS = -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -fno-strict- aliasing -Wdeclaration-after-statement -fwrapv -Wno-address-of-packed-member -Wn o-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-ignored-qualifiers - Wno-missing-field-initializers -Wno-implicit-fallthrough -Wtype-limits -Wshift-n egative-value -Wnull-dereference -DFREEBSD_PORTS
  OPTIONS = USE_PCRE=1 USE_PCRE_JIT=1 USE_REGPARM=1 USE_STATIC_PCRE=1 USE_GETADD RINFO=1 USE_OPENSSL=1 USE_LUA=1 USE_ACCEPT4=1 USE_ZLIB=1 USE_CPU_AFFINITY=1

Feature list : -EPOLL +KQUEUE -MY_EPOLL -MY_SPLICE -NETFILTER +PCRE +PCRE_JIT -P CRE2 -PCRE2_JIT +POLL -PRIVATE_CACHE +THREAD -PTHREAD_PSHARED +REGPARM +STATIC_P CRE -STATIC_PCRE2 +TPROXY -LINUX_TPROXY -LINUX_SPLICE +LIBCRYPT -CRYPT_H -VSYSCA LL +GETADDRINFO +OPENSSL +LUA -FUTEX +ACCEPT4 -MY_ACCEPT4 +ZLIB -SLZ +CPU_AFFINI TY -TFO -NS -DL -RT -DEVICEATLAS -51DEGREES -WURFL -SYSTEMD -OBSOLETE_LINKER -PR CTL -THREAD_DUMP -EVPORTS

Default settings :
  bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX_THREADS=64, default=4).
Built with OpenSSL version : OpenSSL 1.0.2t-freebsd 10 Sep 2019
Running on OpenSSL version : OpenSSL 1.0.2o-freebsd 27 Mar 2018 (VERSIONS DIFFE R!)
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : SSLv3 TLSv1.0 TLSv1.1 TLSv1.2
Built with Lua version : Lua 5.3.5
Built with transparent proxy support using: IP_BINDANY IPV6_BINDANY
Built with zlib version : 1.2.11
Running on zlib version : 1.2.11
Compression algorithms supported : identity("identity"), deflate("deflate"), raw -deflate("deflate"), gzip("gzip")
Built with PCRE version : 8.43 2019-02-23
Running on PCRE version : 8.43 2019-02-23
PCRE library supports JIT : yes
Encrypted password support via crypt(3): yes

Available polling systems :
     kqueue : pref=300, test result OK
       poll : pref=200, test result OK
     select : pref=150, test result OK
Total: 3 (3 usable), will use kqueue.

Available multiplexer protocols :
(protocols marked as <default> cannot be specified using 'proto' keyword)
              h2 : mode=HTTP side=FE mux=H2
              h2 : mode=HTX side=FE|BE mux=H2
       <default> : mode=HTX side=FE|BE mux=H1
       <default> : mode=TCP|HTTP side=FE|BE mux=PASS

Available services : none

Available filters :
        [SPOE] spoe
        [COMP] compression
        [CACHE] cache
        [TRACE] trace

```

Log from Chrome:  
`VM41:1 POST https://vpn.schulte-batenXXX.de/socket.io/?EIO=3&transport=polling&t=N8MUv9n&sid=546c263979164fca9e7eae654fa4d92c 400 (BAD REQUEST)`

I only open the page via http there are no problems.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 15, 2020, 7:21am UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/2 "2020-05-15T07:21:38Z")

</div>

Looks like the error comes from the backend server, what’s in the backend server log?

---

<div class="post-metadata">

**Author:** ![Alexander90](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Alexander90](https://discourse.haproxy.org/u/Alexander90)\
**Post date:** [May 15, 2020, 3:12pm UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/3 "2020-05-15T15:12:45Z")

</div>

Hey! This is the Backend-Server-Log:

```
INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:05] "POST /socket.io/?EIO=3&transport=polling&t=N8OuRdE&sid=afcaa211245749f88987e7f0599c289a HTTP/1.1" 400 122 0.003531

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:08] "GET /socket.io/?EIO=3&transport=polling&t=N8OuSDM HTTP/1.1" 200 29100 0.563801

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:09] "POST /socket.io/?EIO=3&transport=polling&t=N8OuSQG&sid=22a6bf2ea16c494291f2cf34533fe9f0 HTTP/1.1" 400 122 0.000371

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:09] "POST /socket.io/?EIO=3&transport=polling&t=N8OuSSz&sid=22a6bf2ea16c494291f2cf34533fe9f0 HTTP/1.1" 400 122 0.021671

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:11] "GET /socket.io/?EIO=3&transport=polling&t=N8OuSyD HTTP/1.1" 200 29100 0.556703

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:12] "POST /socket.io/?EIO=3&transport=polling&t=N8OuT9-&sid=b3d625d887e9417eaece2b204fde9afd HTTP/1.1" 400 122 0.000404

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:12] "POST /socket.io/?EIO=3&transport=polling&t=N8OuTBr&sid=b3d625d887e9417eaece2b204fde9afd HTTP/1.1" 400 122 0.000360

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:15] "GET /socket.io/?EIO=3&transport=polling&t=N8OuTh5 HTTP/1.1" 200 29100 0.734430

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:15] "POST /socket.io/?EIO=3&transport=polling&t=N8OuTyL&sid=342edd273ddc466d98a0cbb784f996d5 HTTP/1.1" 400 122 0.005293

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:16] "POST /socket.io/?EIO=3&transport=polling&t=N8OuUAL&sid=342edd273ddc466d98a0cbb784f996d5 HTTP/1.1" 400 122 0.000360

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:18] "GET /socket.io/?EIO=3&transport=polling&t=N8OuUP_ HTTP/1.1" 200 29090 0.994597

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:18] "POST /socket.io/?EIO=3&transport=polling&t=N8OuUj-&sid=aa14530115e94ed8a2c5fe23ef985497 HTTP/1.1" 400 122 0.000351

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:19] "POST /socket.io/?EIO=3&transport=polling&t=N8OuUvE&sid=aa14530115e94ed8a2c5fe23ef985497 HTTP/1.1" 400 122 0.000413

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:22] "GET /socket.io/?EIO=3&transport=polling&t=N8OuVOT HTTP/1.1" 200 29100 1.430087

INFO:geventwebsocket.handler:10.4.4.1 - - [2020-05-15 15:09:23] "POST /socket.io/?EIO=3&transport=polling&t=N8OuVtR&sid=db0e8ef4a7c9417a9b0544d415713fce HTTP/1.1" 400 122 0.000341

```

Unfortunately I can not influence the loglevel, since it is a docker container with python code and I have no idea about it. I installed the Docker container on a different server as a test and the same problem. Everything is ok with a direct IP connection. When I go through HAProxy I get these problems.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 18, 2020, 5:50pm UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/5 "2020-05-18T17:50:48Z")

</div>

If your backend is a blackbox, capture the traffic between haproxy and your backend server in a working and in a non-working situation and compare the two.

---

<div class="post-metadata">

**Author:** ![Alexander90](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Alexander90](https://discourse.haproxy.org/u/Alexander90)\
**Post date:** [May 24, 2020, 3:24pm UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/6 "2020-05-24T15:24:51Z")

</div>

The Issue is, that [socket.io](http://socket.io) is being blocked/not forwarded properly with a https frontent (http working fine).

![photo_2020-05-23_12-06-08](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/0/05af615e02bf531d1bf7f3f70b6776c677dbaf80.jpeg)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 26, 2020, 1:46pm UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/7 "2020-05-26T13:46:06Z")

</div>

We already know about the 400 Bad request response. What we need to know is how that requests actually looks like.

---

<div class="post-metadata">

**Author:** ![Alexander90](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Alexander90](https://discourse.haproxy.org/u/Alexander90)\
**Post date:** [May 26, 2020, 3:22pm UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/8 "2020-05-26T15:22:53Z")

</div>

okay I understand. Since I have never done this before, here is my attempt. In pfsense I recorded the packets that are on port 1731 (the port of the web server of the backend). The internal IP of the backend is 10.4.4.10. The internal IP of the pfsense (of the HAProxy) is 10.4.4.1.

[Passwort: haproxy](https://cloud.schulte-batenhorst.de/s/C4XFEeqjKEbxftX)

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [June 18, 2020, 4:55pm UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/9 "2020-06-18T16:55:23Z")

</div>

We can see that the backend rejects the POST request, it’s unclear why.

The “good” capture does not shows a POST request, but a GET request instead, so it’s not really comparable.

Can you provide a working POST capture please?

---

<div class="post-metadata">

**Author:** ![Alexander90](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Alexander90](https://discourse.haproxy.org/u/Alexander90)\
**Post date:** [June 18, 2020, 5:40pm UTC](https://discourse.haproxy.org/t/https-frontend-to-http-backend-400-bad-request/5234/10 "2020-06-18T17:40:47Z")

</div>

The Backendwebserver is a Flask-app which needs a Proxyfix.

> <https://github.com/miguelgrinberg/Flask-SocketIO/issues/1047#issuecomment-549042337>
>
> Hello,
> After some long and unsuccessful research - I found tons of posts with a similar topic but none was able to...

No Problem with HAProxy… with this fix it works. Thanks for your help!