0

If an apache server is acting as a reverse-proxy that terminates the ssl connection, is it able to cache responses? I know that the encrypted responses with ssl cannot themselves be cached, but if apache terminates the ssl connection, it should have access to the unencrypted responses. For clarification, the current apache configuration for the site is as follows:

<VirtualHost *:80>
    ServerName api.beta.robocubs4205.com
    Redirect permanent / https://api.beta.robocubs4205.com
</VirtualHost>
<VirtualHost *:443>
    ServerName api.beta.robocubs4205.com
    SSLEngine On
    SSLCertificateFile /etc/letsencrypt/live/beta.robocubs4205.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/beta.robocubs4205.com/privkey.p$
    ProxyRequests Off
    ProxyPass "/" "http://127.0.0.1:8080/"
    ProxyPassReverse / http://127.0.0.1:8080/
</VirtualHost>

noting that the ProxyPass directive proxies to http and not https. Can I add caching in this scenario? If so, can I do it with the same configuration as with normal http caching, or is there something special I need to do? Also, feel free to point out if there are any big security holes in the configuration I posted.

Edit: would the answer be the same if proxied to another server via https with SSLProxyEngine?

1

I don't see why not, but your web application needs to be very explicit with Cache-Control headers. While the default for http is to cache, the default for https is not to cache (note that these are not official, but what browsers commonly do). If your app relies on the default behavior and does not set Cache-Control appropriately on every response then you may find strange things happen when you switch to https.

| improve this answer | |
  • When I get around to adding cache support to the application, I will add Cache-Control headers everywhere appropriate. I'm going to guess that you statement holds true for proxying to a backend server with ssl and SSlProxyEngine. I'll wait to see if I get a more authoritative answer before marking an answer as accepted. – Trevor Giddings Mar 6 '17 at 6:20
  • 1
    @klikkkolee For the official specification for how caches are supposed to work, see RFC 7234. – Michael Hampton Mar 6 '17 at 6:34
  • That's a great resource, but I meant authoritative with regards to apache's technical capabilities and how to achieve them. I've found a lot of articles on how to do what I ask above with nginx, but for some reason none on apache. I'd normally just play around and test it, but that won't be an option for a while. I wanted to see if someone had tried this before. – Trevor Giddings Mar 6 '17 at 18:19
  • @klikkkolee Aha. I don't know either; I abandoned Apache almost a decade ago to be an nginx early adopter. I don't regret it. – Michael Hampton Mar 6 '17 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.