Tag Info

Hot answers tagged

10

The Apache ProxyPassRewrite does not rewrite the response bodies received from http://test.madeupurl.com, only headers (like redirects to a 404 page and such). A number of alternatives: One) Rewrite the internal app to use relative paths instead of absolute. i.e. ../css/style.css instead of /css/style.css Two) Redeploy the internal app in a the same ...


10

1) How can I remove the [warn] and avoid buffering responses? Is it better to turn off proxy_buffering or set proxy_max_temp_file_size to 0? Why? You should set proxy_max_temp_file_size to 0 in order to remove it. The proxy_buffering directive doesn't directly related to the warning, instead it can switch off buffering at all, which only needed for ...


7

Yes, ProxyPass wins in that case. The way to avoid this problem is: ProxyPass /static/ ! ProxyPass / http://localhost:8000/ ProxyPassReverse / http://localhost:8000/


6

You can't map a port on a public IP address to more than one private IP address, it just won't work because how is the router supposed to know which one to go to? If you're using name-based virtual hosts, you could achieve this by sitting a HAProxy instance in-front of the web instances and direct all traffic from the router to the HAProxy instance. On the ...


5

I find clumsy wonderful : http://jagt.github.io/clumsy/index.html clumsy makes your network condition on Windows significantly worse, but in a managed and interactive manner.


5

Use Rewrite conditions to match for this special case: RewriteEngine On RewriteCond %{REQUEST_URI} ^/socket.io [NC] RewriteCond %{QUERY_STRING} transport=websocket [NC] RewriteRule /(.*) ws://localhost:8082/$1 [P,L] ProxyPass /socket.io http://localhost:8082/socket.io ProxyPassReverse /socket.io ...


4

From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...


4

Came across the same issue with Server version: Apache/2.4.6 As per the documentation at [1], "In 2.4.5 and later, SSLProxyCheckPeerCN has been superseded by SSLProxyCheckPeerName, and its setting is only taken into account when SSLProxyCheckPeerName off is specified at the same time." So adding following entry did the trick.. SSLProxyCheckPeerName off ...


4

This IS possible with Haproxy. You can setup a TCP proxy and extract the SNI and do routing based on the SNI. Here's an example: backend be.app1 mode tcp no option checkcache no option httpclose tcp-request inspect-delay 5s tcp-request content accept if { req.ssl_hello_type 1 } tcp-request content reject use-server server1 if { ...


3

use the X-Forwarded-For Header for this. it is for what i understand exactly designed to solve your problem. see http://en.wikipedia.org/wiki/X-Forwarded-For for details.


3

It sounds as though you are speaking of a reverse proxy. The way this would work is that you would run the reverse proxy in your DMZ. You would give the URL of the reverse proxy to your outside users. When the users browse to the URL you gave them, your reverse proxy receives the connection and request. It then translates or rewrites or just forwards the ...


3

I found what was the error, I needed to add proxy_ssl_session_reuse off;


3

Yes, Squid will cache the reponses from the back-end server(s) using the conventional method of interpreting the headers the back-end server sends with each response. A typical response for dynamic contents that shouldn't be cached looks something like: Expires: Fri Jul 25 10:19:36 CEST 2014 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: ...


3

Edit: (1) Sorry, some typo here (2) I adjust regex so it matches one or more slash before string mybucket like your log above. Well, maybe you mean something like this location ~* ^/https://s3\.amazonaws\.com/+mybucket(.*) { ... proxy_pass http://s3.amazonaws.com/mybucket$1; }


3

Apache would see the IP address 192.168.0.123 as the source and that needs to be added the RPAF_proxyips directive, this tells mod_rpaf that its a known proxy. Quoting from http://www.stderr.net/apache/rpaf/ It changes the remote address of the client visible to other Apache modules when two conditions are satisfied. First condition is that the remote ...


2

Trailing slash must be added to path, it's necessary to handle web socket requests as GET requests (httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypass) something like: ProxyPass /my_app/BasicWebsocketServlet/ ws://1X.X.X.1:8080/my_app/BasicWebsocketServlet/ retry=0 ProxyPassReverse /my_app/BasicWebsocketServlet/ ...


2

Jetty was the first Java server to support SPDY, and it does have a SPDY reverse proxy that supports SPDY towards the backend (along with HTTP). Since Jetty is one of the few servers (if not the only) that is able to perform SPDY Push in a transparent way for applications (check this video that shows the big performance benefits of SPDY Push in Jetty) , ...


2

[Tue Jan 14 16:38:37.054643 2014] [proxy:warn] [pid 12715] [client 98.253.179.182:58922] AH01144: No protocol handler was valid for the URL /. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule. [Tue Jan 14 16:38:38.991741 2014] [proxy:warn] [pid 12619] [client 98.253.179.182:58923] ...


2

Should be able to accomplish this with <Limit>: <Limit GET HEAD POST> ProxyPass / http://example.com/ </Limit> Edit: Picky directives.. we'll go with plan B. RewriteCond %{REQUEST_METHOD} ^(GET|HEAD|POST)$ RewriteRule ^/(.*)$ http://example.com/$1 [P,L]


2

There was a time that the default install of Apache simply had fewer known security holes than a default install of IIS; that alone was a security improvement. Thus, it may have simply become tribal lore because it was once a best practice.


2

Ideally you can redeploy your applications such that each application is installed in http://app<n>.com/app<n> instead of the document root. If not maybe you can have the links made relative, instead of linking to /images/logo.png link to ../images/logo.png or images/logo.png or ../../images/logo.png depending on the page that's served, which ...


2

nginx added this as a new feature in development version 1.5.7. Add proxy_cache_revalidate on; to your proxy cache configuration, and nginx will revalidate stale content with If-Modified-Since.


2

I think you added something / extra in your config settings... Look at this line: proxy_pass http://IP_ADD_TOMCAT_SERVER:8080/; you need to remove the trailing slash and it should work fine. like this: proxy_pass http://IP_ADD_TOMCAT_SERVER:8080; try it out and see if things go fine!! Update#1 I just noticed that you have another mistake "same typo" ...


2

This doesn't work because the if is evaluated before the request is passed to the backend, so the $upstream_http_ variables don't have any values yet. add_header with an empty value is ignore, so you can use a map to conditionally add the header like so: map $upstream_http_strict_transport_security $sts { '' max-age=15552000; } server { location / { ...


2

You express configured to serve path /index.html, but you requires /test-express/index.html. Either configure express to serve /test-express/index.html or make nginx to strip /test-exress from proxied request. Latter is as simple as add trailing slashes to location and proxy_pass. location /test-express/ { proxy_pass http://127.0.0.1:3002/; } See ...


2

You're not missing anything; you configured nginx correctly. The problem here is that WordPress thinks it should be generating HTTP links. When you try to access it via HTTPS, it still generates all of its links with http:// and thus they can't be loaded (without explicitly loading insecure content in the browser). There are WordPress plugins that will ...


2

Your approach is flawed. You do not want to use the domain names when configuring iptables. Your firewall has no notion of which domain a client has resolved to reach your hostsystem. All it sees are the IP address and port number. If you want to make the containers reachable via a public IP, you need to choose a distinct IP that is available on the ...


2

It's not IP as in IP address, but IP as in instruction pointer. You've encountered a bug in nginx. Consider upgrading, if you are running an outdated version. You could also file a bug report if you can tell what happened immediately before the segfault (check the rest of the log) or have a coredump (as long as there is nothing confidential on the ...


2

Both location directives need to be in the same vhost configuration. Different vhosts are meant to allow different host names and/or protocols to be served by the same server. What you have done effectively is to create two vhosts, but without a means to differentiate the two, e.g. with the server_name directive. Since it can't differentiate them, nginx ...


2

You should learn how Nginx handle location. See this old wiki or new one or this blog. The summary: There are 4 types of location rule, and are applied with the following priorities: Exact matches: There can be only one exact match – the clue is in the name!. For example: location = /foo/bar High priority prefix: There can be more than ...



Only top voted, non community-wiki answers of a minimum length are eligible