0

I have set up Apache 2.4.6 on Centos with mod_proxy and mod_headers like described in https://wiki.apache.org/httpd/LoadBalanceWithoutStickyCookie
My goal is to have sticky sessions even if the backend server does not generate a session cookie by itself. Most of the time, this works, but sometimes, POST requests go to a different backend server that the GET requests do.

Here's the relevant part of my config file:

RequestHeader set X-Forwarded-Proto "https"
RequestHeader set SSL-FRONTEND "yes"

## Proxy rules
ProxyRequests Off
ProxyPreserveHost On

# define a balancer
<Proxy balancer://mycluster>
  BalancerMember http://backendserver1 route=route1 loadfactor=1 ttl=300
  BalancerMember http://backendserver2 route=route2 loadfactor=1 ttl=300
  Proxy 
</Proxy>
# set a sticky cookie
Header add Set-Cookie "ROUTEID=sticky.%{BALANCER_WORKER_ROUTE}e; path=/" env=BALANCER_ROUTE_CHANGED

ProxyPass / balancer://mycluster/ stickysession=ROUTEID
ProxyPassReverse / balancer://mycluster/

When I go to the network tab of the browser and analyse the requests, I can see, that all GET have the same ROUTEID cookie (e.g. sticky.route1), but the POST request (here: csp-report because we are using Content Security Policy with an report-URL), sometimes go to the other backend server and the ROUTEID coookie is sometimes different here - e.g. sticky.route2

I searched, but couldn't find a solution so far.

Has anyone else experienced such a problem?
Could you help me, please?

Thanks and best regards,
Alexander

Update 2019-01-16: It looks like this is actually not a problem with apache or load-balancing, but a slight "problem" with the CSP implementation in the browsers (tested: FireFox and Chrome).
It looks like browsers use a different implementation on how they perform the POST calls to the report-url that is specified in the Content-Security-Policy header: they just don't send the browser cookies for the given site to the report-url. Thus apache cannot match this request to the other requests.
If no one comes up with a better explanation, I'll self-answer this question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.