External urls redirect to "https://xxxx/xxx/xxx/checkout/onepage/" denied!

[f1-outsourcing]

I am getting this error on the buy it now button, however I am just able to do a normal checkout (onepage checkout)

"External urls redirect to "https://xxxx/xxx/xxx/checkout/onepage/" denied!"

I am running magento on a proxy, looks like magento does not detect this. This is my proxy path https://xxxx/xxx/xxx/

How should I debug this?

[kiatng]

Start here:

magento-lts/app/code/core/Mage/Checkout/controllers/CartController.php

Lines 68 to 75 in 1fb8813

	protected function _goBack()
	{
	$returnUrl = $this->getRequest()->getParam('return_url');
	if ($returnUrl) {
	if (!$this->_isUrlInternal($returnUrl)) {
	throw new Mage_Core_Exception('External urls redirect to "' . $returnUrl . '" denied!');
	}

magento-lts/app/code/core/Mage/Core/Controller/Varien/Action.php

Lines 801 to 814 in 1fb8813

	protected function _isUrlInternal($url)
	{
	if (str_contains($url, 'http')) {
	/**
	* Url must start from base secure or base unsecure url
	*/
	if (str_starts_with($url, Mage::app()->getStore()->getBaseUrl())
	|| str_starts_with($url, Mage::app()->getStore()->getBaseUrl(Mage_Core_Model_Store::URL_TYPE_LINK, true))
	) {
	return true;
	}
	}
	return false;
	}

[kiatng]

May be you set your xxx URL here

[f1-outsourcing]

I can't change that. I am testing with having multiple websites (with different domains) include a few products and a checkout on that same domain.

[f1-outsourcing]

Start here:

Ok thanks I will try!

[f1-outsourcing]

What is exactly the logic behind this protection? This can be abused somehow? I was thinking of solving this by doing some proxy check and then allowing the url, but this to can be opening up for abuse.

Matomo fixed this by having the proxy add a header and you can test on that. This way nobody can see this "configured" header and if you test on that it should be even more secure.

But I don't really get this check, I would think that once the procedure is started under this root path, why not just finish it.