-2

We want to preserve the original client IP when proxying a request from Apache to our application.

We currently have a setup like this:

CLIENT --123.2.3.4--> APACHE --127.0.0.1--> API

But want it to be:

CLIENT --123.2.3.4--> APACHE --123.2.3.4--> API

I know we could be looking in the Forwarded-For header for the original remote address; but the idea is that this should not be a concern for our API application, the API does not need to know that it may or not be behind a proxy, but rather, look for the IP and find it every time.

We have tried with mod_proxy and mod_remoteip but have been unsuccessful.

1

I would use mod_remoteip if you can, but note that you will have to change logformat to use %a rather than %h to see the address in your logs.

Also, the answer does rather depend on how your application, which is reverse-proxied, is connected to by Apache.

Fundamentally, something has to communicate this to your application. If your are using mod_php, mod_fcgi, mod_wsgi, mod_proxy_ajp then this is happily already done for you.

If, on the other hand, you are simply using mod_proxy_http, then you need to ensure the requisite data is passed in via a header (such as X-Forwarded-For) and also that you use ProxyPreserveHost. Similarly you need to send whether http or https was used at the front-end and even what port was used. All of this is very important to get things like hyperlink and cookie formulation working correctly. Otherwise you have to explicitly tell the application what its front-end settings are (which is perhaps simpler).

Apache Tomcat (like many J2EE middleware containers) let you set this sort of environmental detail in a Connector.

For Tomcat workloads I would generally recommend AJP because it's just so much simpler; but if WebSockets enters the mix, which isn't supported by AJP, then you have to fall back to HTTP, and thus configure things in the backend. This doesn't require configuring the application (in a J2EE sense of the word) just the containing runtime environment.

Something, somewhere, and someone has to support this complexity. And application vendors should really make sure that this can work. If anything, cleanly supporting such environments are more important as workloads move into containerised environments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.