2

I have two configurations - development and staging - with (supposedly) identical configurations: a set of HTTP-only Apache instances sitting behind a Citrix load balancer that allows both HTTP and HTTPS connections.

The Apache VirtualHost definitions contain the following directives:

RedirectMatch permanent /something/endpoint(.*)$ /something/otherendpoint$1
SSLProxyEngine On
ProxyPass /something/endpoint !
ProxyPass /something https://192.168.1.100:6443/something
<Location /something>
ProxyPassReverse https://192.168.1.100:6443/something
</Location>

So, I want to proxy any requests for /something to a different backend HTTPS server, except for /something/endpoint, which I need to redirect.

Now, everything is working fine in my development environment. I can access http://hostname/something/endpoint and it will redirect me to http://hostname/something/otherendpoint. Likewise, I can access https://hostname/something/endpoint and it will redirect me to https://hostname/something/otherendpoint.

But in the staging environment, both http://hostname/something/endpoint and https://hostname/something/endpoint redirect to http://hostname/something/otherendpoint - it does not preserve HTTPS.

I have been pulling my hair out trying to figure out what the difference is between the two configurations. There must be something causing Apache to not respect the access protocol, but I'm not able to isolate it. The HTTP response headers look the same in both environments, except for the redirect Location header that specifies http instead of https.

Any ideas about what configuration difference could be causing this?

Improve this question
4
  • Do you have any differences in other apache configs outside vhosts? Does your balancer do SSL termination? If you terminate SSL on balancer, validate if balancer is routing HTTPS requests to HTTPS port on your backend web servers. You can check what is the schema in request by logging it using %{REQUEST_SCHEME}x in your LogFormat, to confirm what you receive on web servers. See David Caldwell answer on this thread serverfault.com/questions/359476/…. With your RedirectMatch definition pay attention to generating self-referential URLs. Read the
    – Dekiel
    Feb 8, 2017 at 20:44
  • Read the ServerName and UseCanonicalName directives description httpd.apache.org/docs/current/mod/core.html#servername. Share some details how you already troubleshoot this issue, to not go through the same here. As a quick solution, you can set result URL in RedirectMatch directive with schema and FQDN explicitly.
    – Dekiel
    Feb 8, 2017 at 20:44
  • I don't believe there are any other apache config differences. Yes, the load balancer is responsible for SSL termination, and proxies that traffic to the backend servers via HTTP. So I suppose it's unsurprising that the generated redirect location is http:// - however it's strange that the two environments differ in behavior. One would assume the load balancer is modifying that header to match to the requested protocol, but I'm not sure (and doesn't explain why the two environments differ). I do not want to set the FQDN explicitly because there are multiple server aliases.
    – greenlaw
    Feb 10, 2017 at 15:35
  • Could you post an obscured version of the relevant apache configs for the sites and global? That will help us better help you see if there is a config issue with apache.
    – SteamerJ
    Dec 18, 2018 at 13:52

1 Answer 1

Reset to default
0

Please remember that permanent redirects get cached by your webbrowser, you will need to either manually clear the browser cache after each test/modification in your configuration or test in "incognito"/"anonymous" browser windows.

How apache httpd merges configuration directives can be a bit tricky. The syntax you're using seems a bit inconsistent and might be the cause of your issues:

ProxyPass /something https://192.168.1.100:6443/something
<Location /something>
ProxyPassReverse https://192.168.1.100:6443/something
</Location>

For clarity please use either:

ProxyPass /something/endpoint !
ProxyPass /something https://192.168.1.100:6443/something
ProxyPassReverse /something https://192.168.1.100:6443/something

or enclose everything in Location directives:

<Location /something>
  ProxyPass  https://192.168.1.100:6443/something
  ProxyPassReverse https://192.168.1.100:6443/something
</Location>
<Location /something/endpoint>
  ProxyPass  "!"
  Redirect permanent /something/otherendpoint
</Location>
Improve this answer
1
  • Thanks for the response. I am testing with incognito, definitely not a caching issue. Part of the formatting/order of the directives is decided by the Puppet Apache module, so I don't have direct control over that unless I keep adding to custom_fragment...which is possible...but the fact that the virtualhost configuration is the same in both environments would point to something else as the root cause. At the moment I'm leaning toward a load balancer configuration issue.
    – greenlaw
    Feb 8, 2017 at 1:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .