Avatar images broken behind proxy

Product Support

AI-generated summary

The discussion revolves around avatar images failing to load due to a new firewall rule requiring outbound HTTP/S requests to be whitelisted via a proxy or direct rule. rbos explains that after setting up a direct rule for $URL_GRAVATAR and configuring no_proxy, avatar images still failed, resulting in 500 errors. The issue was traced to a 302 redirect from $URL_GRAVATAR to another domain. Falco identifies that access to https://avatars.discourse-cdn.com is required for letter avatars. rbos confirms the issue was resolved after whitelisting the correct domain, though the lack of access to outgoing proxy logs made troubleshooting difficult.

1

Hello,

We recently had a firewall rule imposed on our servers such that all outbound HTTP/S requests had to be whitelisted to go outbound, either through a proxy or with a direct rule. Since then, some images have failed to load, in particular, avatars generate a 500 error, eg, [url]/letter_avatar_proxy/v4/letter/d/8edcca/45.png

edit before posting: The forum software understandably complains about links in posts by new users, so please substitute “$URL_GRAVATAR” = “www.gravatar.com”

My best guess is that it’s trying to access $URL_GRAVATAR from within the container. I had our firewall guy set up an exception so that $URL_GRAVATAR gets a direct rule, and set "no_proxy=‘$URL_GRAVATAR’ and rebuilt the container.

Within the container, I verify that no_proxy is set, and I can curl directly to the URL:

no_proxy='$URL_GRAVATAR,[etc],127.0.0.0/8'

# curl -Ik https://$URL_GRAVATAR
HTTP/2 302 
server: nginx

But, images still appear to be broken. Is there something I’m missing? I don’t have access to external logs to show what exactly it’s failing to access.

edit: the 302 redirect there is possibly the problem, it redirects to another address that I perhaps need to whitelist. If I do curl -IL $URL_GRAVATAR it gives me a proxy failure.

2

You need to allow https://avatars.discourse-cdn.com/ to fix the letter avatar.

3

Thanks, I’ll try that! Just gotta schedule a half hour downtime for the Discourse rebuild. :slight_smile:

Super frustrating trying to guess the access that stuff needs without access to the outgoing proxy logs. :confused:

4

Confirmed working, by the way. Thanks!