Not able to Deposit and Withdraw Money by using Custom Stellar Anchor in Demo Wallet

Question

I built a Stellar Anchor Service under home domain "poc.utilli.co".

You can find the Stellar Toml file for that service with this link. https://poc.utilli.co/.well-known/stellar.toml

Problem that I am facing:

I am unable to make deposit and withdrawl transactions with my anchor service on "demo-wallet". I was able to see the Asset that I Anchored and was able to create trustline to the login account.

But, during the SEP-24 Deposit and Withdrawl the Pop-up for user interactivity is not showing the UI for entering the amount and KYC details.

On debugging using the console, the anchor is hosted in home domain which is "https", whereas the url I am getting while doing the SEP-24 deposit is not "https".

While checking in the Stellar Anchor Tests service

URL: https://anchor-tests.stellar.org

I am getting following error:

[![Anchor Test Validator Error in SEP24][1]][1] [1]: https://i.stack.imgur.com/BhOGn.png

Also when trying to see the API that is called when SEP-24 Deposit is done I am getting following URL

http://poc.utilli.co/sep24/transactions/deposit/webapp?asset_code=XXXXX&transaction_id=XXXXXXX

For confidentiality I am hiding the asset_code and transaction_id. But, the point of my concern is API is called in http not in https.

Anyone, could you please suggest me what is the mistake that I am doing.

I followed all the steps metioned in the django-polaris readthedocs website. https://django-polaris.readthedocs.io/

Answer 1

Polaris use's Django's request.build_absolute_uri() to generate the URL included in POST /transactions/interactive/deposit responses. Per the docs:

Mixing HTTP and HTTPS on the same site is discouraged, therefore build_absolute_uri() will always generate an absolute URI with the same scheme the current request has. If you need to redirect users to HTTPS, it’s best to let your Web server redirect all HTTP traffic to HTTPS.

So if Polaris is returning HTTP URLs, your application is receiving HTTP requests.

The Stellar Demo Wallet uses HTTPS in all requests though. So whats going on?

A common architecture, especially in cloud environments like AWS, is to use a load balancer that routes requests to application servers. These load balancers typically accept HTTPS requests from external clients and forward those requests to the application as HTTP requests.

To ensure Django applications sitting behind load balancers (or more generally, reverse proxies) generate URLs with the protocol used by the external client, Django offers the SECURE_PROXY_SSL_HEADER setting. In 99% of cases, you're going to want to assign the following value:

SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

This tells Django's middleware to check the request for a X-Forwarded-Proto header, and if the value is https, the request is considered "secure", which means a call to build_absolute_uri() in this request/response cycle will generate a HTTPS URL.

The X-Fowarded-Proto header is added to the request by the load balancer / reverse proxy. Its possible that your proxy uses a different header though, in which case you'd want to adjust the value assigned to SECURE_PROXY_SSL_HEADER appropriately.