-1

We would like to redirect an apache website to a remote tomcat server, but the tomcat does not use https.

The apache is hosted on AWS so it does use https.

We have a mobile app that should target httpS://mypublicserver/:port and end up at http://myinternalserver/app.

Question is, is this possible? or does the encryption gets lost between the public server and the app? (the connection between the public server and the internal server is done over VPN).

1
  • 2
    Yes will work. A redirect is a redirect. You might be better served with a proxy ( httpd.apache.org/docs/2.4/mod/mod_proxy.html ), though (and keep https). And tomcat does ssl/https afaik. Everything should be https when possible.
    – B. Shea
    Oct 8, 2020 at 21:25

1 Answer 1

1

A lot of companies do not use end to end encryption, yet they have configurations similar to yours. BShea is correct, it will work, and a proxy is the route you want to go. Here is an example.

Tomcat has connectors, with the HTTP connector turned on by default. Apache has the same concept, allowing for HTTP and HTTPS traffic, with HTTP enabled by default.

After setting up SSL on Apache, you have encryption while the request travels to the Apache server (normally the only publicly visible part of the transaction), forwarding requests to the Tomcat server, over an unencrypted connection. The end user still sees the request to the apache server as secure, using encryption, because the request is proxied to the Tomcat server (behind the scenes.)

Full end-to-end encryption would involve enabling the HTTPS connector on the Tomcat server, which is not complicated, thus ensuring the traffic is always encrypted when traveling across the wire. (And using HTTPS protocol in the proxy instead of HTTP)

All of this said, you don't have to have encryption on Tomcat, but you don't really want a redirect. It is simple to use the proxy. Proxy the request simply by:

ProxyPass "/therequest/url/" "http://tomcat.server.ip.or.dns:8080/" ProxyPassReverse "/therequest/url/" "http://tomcat.server.ip.or.dns:8080/" (Don't forget to load the proxy module, http_proxy, anything required.)

This will expose the Apache endpoint to the user, and all they will see is encrypted traffic. If you do a redirect you will be dropping out of encrypted mode for the end user. Don't do this.

Hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .