If the application server (e.g. Apache Tomcat) on which Xima® Formcycle is installed is running behind another server, e.g. a reverse proxy, a load balancer or similar, it should be checked that the information of a request is passed on to it unchanged. In concrete terms this means that both the Host header and the protocol used must be passed on unchanged by the intermediate servers. In most standard configurations, however, this is not the case because the requests are received by the intermediary server and sent to the application server as a new request. 

The problematic scenario (see figure) is the following:

1. The user calls the URL https://www.example.com/formcycle.
2. The request is received and evaluated by the intermediate server.
3. The intermediate server makes a new request to the designated server. However, since an internal request is made here, the call URL is changed to http://192.168.0.1/formcycle. This URL now arrives at the application server and no longer contains the required information about which URL was actually called by the user.

Example configuration Apache

For the correct configuration of an Apache server, which acts as a reverse proxy, two points are relevant and have to be stored e.g. in the configuration of the VirtualHosts:

1. The instruction ProxyPreserveHost On to get the originally called Host header 
2. The separation of the individual protocols and its usage when forwarding to the application server. This means that for HTTP and HTTPS a separate VirtualHost with appropriate configuration must be used. 

This configuration, as well as any settings that may be necessary when using self-generated certificates, is briefly illustrated here: