Problem & Solution: Rstudio Server behind multiple reverse-proxies breaks help pane on client

[jonathan-g]

I present a problem and its solution. I'm posting it in just case anyone else runs into it, but it's a pretty edge case so I'm expecting that few if any are running into this. It only applies when you have RStudio Server running behind multiple layers of reverse-proxying.

I have several RStudio server instances on different machines, which are all reverse-proxied through one central server. The topology is an nginx instance on the main server (call it "alpha") reverse-proxies RStudio links to a second nginx instance running on the appropriate box (call it "beta"; there are also "gamma," "delta," etc.), and the nginx instance on "beta" reverse-proxies RStudio traffic to the RStudio Server instance on "beta".

Everything works well except that the help pane in the client remains blank and doesn't show any help.

The problem turned out to be that by default the nginx reverse-proxy server on "beta" was setting the http X-Frame-Options header to "DENY", which prevented an iframe served by "alpha" from referencing the content served by "beta".

Editing the nginx configuration on "beta" to include the line

add_header X-Frame-Options "SAMEORIGIN";

solved the problem.

Related instructions for setting X-Frame-Options for other web servers, such as Apache, can be found at https://stackoverflow.com/questions/27358966/how-to-set-x-frame-options-on-iframe and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Here is the full "location" section of my reverse-proxy configuration for nginx on "beta":

 location /rstudio/ {
    allow <alpha_ip>; # substitute the actual IP address for alpha instead of 
                      # <alpha_ip>. This prevents anyone from accessing this
                      # instance of RStudio Server except through the main 
                      # reverse-proxy server at "alpha".
    deny all;

    rewrite ^/rstudio/rstudio/(.*)$ /rstudio/$1 break;
    rewrite ^/rstudio/(.*)$ /$1 break;
    proxy_pass http://localhost:8787;
    proxy_redirect http://localhost:8787 $scheme://$http_host/rstudio;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_read_timeout 2h;

    add_header X-Frame-Options "SAMEORIGIN";
    }