8

I have an odd setup. It looks like this:

Browser ----------> HTTPs Proxy ------> Apache HTTP -----> Tomcat AJP
           HTTPS                 HTTP                AJP

On the HTTPS proxy (a very dumb proxy), a URL comes in looking like https: //proxy.domain.com/app. It is then tunneled to Apache using HTTP as is http: //apache.domain.com/app (passing in the host proxy.domain.com). Apache then tunnels the request locally using the AJP protocol to ajp: //localhost:8009/app/.

Sometimes the app server wants to redirect the requested path. For example, redirect /app/ to /app/webapp. So, it sends a 302 back to apache redirecting the path - probably something like ajp: //localhost:8009/app/webapp. Apache then rewrites the redirect URL to http: //proxy.domain.com/app/webapp. The HTTPS proxy is dumb, so it does not analyze the redirect and change the http to https.

So, I would like to figure out if I can configure Apache to re-write the 302 redirect URL to send the user to https.

Here is the config I have so far in Apache's https.conf:

ProxyPreserveHost       on
RewriteEngine           on
RewriteRule ^/app$ /app/ [PT]
ProxyPass /app ajp://localhost:8009/app

I tried using ProxyPassReverse, but haven't been able to figure out how to force it to rewrite the 302 redirect URL with https instead of http.

Any thoughts?

2 Answers 2

9

I always wrestle with a problem for hours before giving up and posting a question - only to solve my own problem minutes after posting ...

For those interested, the solution is not to use ProxyPassReverse, but rather to use the Header directive - it' let's you mess with outbound headers. In this case, I can capture the Location response header and run a regex on it to fix the URL's protocol:

ProxyPreserveHost       on
RewriteEngine           on
RewriteRule ^/app$ /app/ [PT]
ProxyPass /app ajp://localhost:8009/app
Header edit Location ^http(\:\/\/proxy.*)$ https$1

Voila!

If apache complains, it might be that mod_headers is not yet enabled: a2enmod headers

2
  • No need to edit the headers, go for @wondy solution to make tomcat know about the LB/RProxy protocol through RempteIpValve May 29, 2015 at 13:21
  • I used this solution. I much prefer doing some Apache config rather than making tomcat do what I want!
    – froderik
    Jun 8, 2016 at 14:28
3

I've found another option.

Based on https://stackoverflow.com/questions/5741210/handling-x-forwarded-proto-in-java-apache-tomcat and Apache ReverseProxyPass redrects to http rather than https it seems some servers recognize the X-Forwarded-Protocol header. One can make Tomcat recognize it by adding:

<Valve className="org.apache.catalina.valves.RemoteIpValve" protocolHeader="x-forwarded-protocol" />

to server.xml.

3
  • 1
    This is the best solution, hence tomcat is designed to work this way May 29, 2015 at 13:21
  • I think you mean X-Forwarded-Proto. Oct 2, 2015 at 4:32
  • I am quite sure I have used "Protocol" and it worked. But it was March 2013. I can see both versions have been used for some time. As I can see in the meantime a new RFC 7239 has been written (June 2014). Probably the "Proto" version has won and is the standard now.
    – wodny
    Oct 2, 2015 at 8:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .