Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an odd setup. It looks like this:

Browser ----------> HTTPs Proxy ------> Apache HTTP -----> Tomcat AJP
           HTTPS                 HTTP                AJP

On the HTTPS proxy (a very dumb proxy), a URL comes in looking like https: // It is then tunneled to Apache using HTTP as is http: // (passing in the host Apache then tunnels the request locally using the AJP protocol to ajp: //localhost:8009/app/.

Sometimes the app server wants to redirect the requested path. For example, redirect /app/ to /app/webapp. So, it sends a 302 back to apache redirecting the path - probably something like ajp: //localhost:8009/app/webapp. Apache then rewrites the redirect URL to http: // The HTTPS proxy is dumb, so it does not analyze the redirect and change the http to https.

So, I would like to figure out if I can configure Apache to re-write the 302 redirect URL to send the user to https.

Here is the config I have so far in Apache's https.conf:

ProxyPreserveHost       on
RewriteEngine           on
RewriteRule ^/app$ /app/ [PT]
ProxyPass /app ajp://localhost:8009/app

I tried using ProxyPassReverse, but haven't been able to figure out how to force it to rewrite the 302 redirect URL with https instead of http.

Any thoughts?

share|improve this question

I always wrestle with a problem for hours before giving up and posting a question - only to solve my own problem minutes after posting ...

For those interested, the solution is not to use ProxyPassReverse, but rather to use the Header directive - it' let's you mess with outbound headers. In this case, I can capture the Location response header and run a regex on it to fix the URL's protocol:

ProxyPreserveHost       on
RewriteEngine           on
RewriteRule ^/app$ /app/ [PT]
ProxyPass /app ajp://localhost:8009/app
Header edit Location ^http(\:\/\/proxy.*)$ https$1


If apache complains, it might be that mod_headers is not yet enabled: a2enmod headers

share|improve this answer
No need to edit the headers, go for @wondy solution to make tomcat know about the LB/RProxy protocol through RempteIpValve – Muhammad Hewedy May 29 '15 at 13:21
I used this solution. I much prefer doing some Apache config rather than making tomcat do what I want! – froderik Jun 8 at 14:28

I've found another option.

Based on and Apache ReverseProxyPass redrects to http rather than https it seems some servers recognize the X-Forwarded-Protocol header. One can make Tomcat recognize it by adding:

<Valve className="org.apache.catalina.valves.RemoteIpValve" protocolHeader="x-forwarded-protocol" />

to server.xml.

share|improve this answer
This is the best solution, hence tomcat is designed to work this way – Muhammad Hewedy May 29 '15 at 13:21
I think you mean X-Forwarded-Proto. – Michael Hampton Oct 2 '15 at 4:32
I am quite sure I have used "Protocol" and it worked. But it was March 2013. I can see both versions have been used for some time. As I can see in the meantime a new RFC 7239 has been written (June 2014). Probably the "Proto" version has won and is the standard now. – wodny Oct 2 '15 at 8:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.