0

This makes me really a headache!

At first a schema that explains the matter much more efficient:

  ------WWW / Internet--||-------------Intranet---------------

  +----------+            +----------+    HTTP    +----------+
  |          |            |  SSL     | ---------> |  Web  3. |
  |  Client  |     1.     |  reverse |     2.     |  App     |
  |          | ---------> |  Proxy   |            |  Server  |
  +----------+   HTTPS    +----------+            +----------+
  1. The client requests the reverse proxy over SSL.
  2. The reverse proxy does the protocol switch to http and forwards the request packet (ProxyPreserveHost is on)
  3. The application server generates static links out of the request header "host" variable. With all the goodies FQDN and protocol (http://FQDN.tld:80/etc) :-( You know what the App Server answers when I fiddle with the header host variable... (Bad Request)
  4. After that the reverse proxy sends the response to the client over SSL.
  5. Naturally the clients requests all the linked images and stylesheets over http. This requests ask the reverse proxy and falls on deaf ears.

Solutions which are not welcome:

  • SSL inside the intranet (security, performance and less debugging options)
  • Appserver is not modifiable (not discussible)
  • mod_proxy_html (performance, the DOM parser destroys many JS's)
  • no http traffic is allowed in the Internet zone (security)

Everything works, only the protocol switching makes trouble with the static links. Redirects get managed with ProxyPassReverse, but this doesn't effect the static links.

How can I manage that the static links go over https?
It would be enough if the protocol and the appended port number could be removed!

Did anyone need more information I will provide it here:

Proxy is apache 2.2.17!
AppServer is jboss with tomcat 5.5!

Many thanks Hendrik

6
  • What are you using as your SSL proxy and web application server?
    – vsltd
    Apr 12, 2011 at 9:51
  • Is the app server appending/inserting the port number? If so, why is the app server configuration untouchable? Is the app itself unmodifiable, too?
    – mahnsc
    Apr 12, 2011 at 10:04
  • Application information provided in Question.
    – Hendrik
    Apr 12, 2011 at 10:31
  • The appserver append the ":80" yes. The app server is provided by the customer and the customer is not able to modify a thing. (TeamCenter)
    – Hendrik
    Apr 12, 2011 at 10:34
  • I am not sure you know but do you happen to know what framework is being used here? Seam, GWT, etc. Sometimes I see cases where responses have the port number appended and sometimes this doesn't happen.
    – mahnsc
    Apr 12, 2011 at 10:36

1 Answer 1

0

Set the proxyName and proxyPort in server.xml, set scheme to "https". See: http://tomcat.apache.org/tomcat-5.5-doc/config/http.html

1
  • Thanks! This wasn't a bad idea. ProxyName and proxyPort are working. But the scheme parameter don't. Requests go to http! Can this work under a http request? If yes, how?
    – Hendrik
    Apr 26, 2011 at 9:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .