This makes me really a headache!

At first a schema that explains the matter much more efficient:

  ------WWW / Internet--||-------------Intranet---------------

  +----------+            +----------+    HTTP    +----------+
  |          |            |  SSL     | ---------> |  Web  3. |
  |  Client  |     1.     |  reverse |     2.     |  App     |
  |          | ---------> |  Proxy   |            |  Server  |
  +----------+   HTTPS    +----------+            +----------+
  1. The client requests the reverse proxy over SSL.
  2. The reverse proxy does the protocol switch to http and forwards the request packet (ProxyPreserveHost is on)
  3. The application server generates static links out of the request header "host" variable. With all the goodies FQDN and protocol (http://FQDN.tld:80/etc) :-( You know what the App Server answers when I fiddle with the header host variable... (Bad Request)
  4. After that the reverse proxy sends the response to the client over SSL.
  5. Naturally the clients requests all the linked images and stylesheets over http. This requests ask the reverse proxy and falls on deaf ears.

Solutions which are not welcome:

  • SSL inside the intranet (security, performance and less debugging options)
  • Appserver is not modifiable (not discussible)
  • mod_proxy_html (performance, the DOM parser destroys many JS's)
  • no http traffic is allowed in the Internet zone (security)

Everything works, only the protocol switching makes trouble with the static links. Redirects get managed with ProxyPassReverse, but this doesn't effect the static links.

How can I manage that the static links go over https?
It would be enough if the protocol and the appended port number could be removed!

Did anyone need more information I will provide it here:

Proxy is apache 2.2.17!
AppServer is jboss with tomcat 5.5!

Many thanks Hendrik

  • What are you using as your SSL proxy and web application server? – vsltd Apr 12 '11 at 9:51
  • Is the app server appending/inserting the port number? If so, why is the app server configuration untouchable? Is the app itself unmodifiable, too? – mahnsc Apr 12 '11 at 10:04
  • Application information provided in Question. – Hendrik Apr 12 '11 at 10:31
  • The appserver append the ":80" yes. The app server is provided by the customer and the customer is not able to modify a thing. (TeamCenter) – Hendrik Apr 12 '11 at 10:34
  • I am not sure you know but do you happen to know what framework is being used here? Seam, GWT, etc. Sometimes I see cases where responses have the port number appended and sometimes this doesn't happen. – mahnsc Apr 12 '11 at 10:36

Set the proxyName and proxyPort in server.xml, set scheme to "https". See: http://tomcat.apache.org/tomcat-5.5-doc/config/http.html

  • Thanks! This wasn't a bad idea. ProxyName and proxyPort are working. But the scheme parameter don't. Requests go to http! Can this work under a http request? If yes, how? – Hendrik Apr 26 '11 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.