Hide last authors
MKO 31.1 1 If the application server (e.g. Apache Tomcat) on which {{formcycle/}} is installed is running behind another server, e.g. a reverse proxy, a load balancer or similar, it should be checked that the information of a request is passed on to it unchanged. In concrete terms this means that both the //Host// header and the protocol used must be passed on unchanged by the intermediate servers. In most standard configurations, however, this is not the case because the requests are received by the intermediate server and sent to the application server as a new request.
MKO 5.2 2
MKO 31.1 3 {{figure image="proxy_en.jpg"}}
4 Manipulation of the host and the protocol by a reverse proxy.
MKO 16.1 5 {{/figure}}
MKO 5.2 6
MKO 31.1 7 The problematic scenario (see figure) is the following:
MKO 5.2 8
MKO 31.1 9 1. The user calls the URL {{code language="none"}}https://www.example.com/formcycle{{/code}}.
10 1. The request is received and evaluated by the intermediate server.
11 1. The intermediate server makes a new request to the designated server. However, since an internal request is made here, the call URL is changed to {{code language="none"}}http://192.168.0.1/formcycle{{/code}}. This URL now arrives at the application server and no longer contains the required information about which URL was actually called by the user.
MKO 17.1 12
13 {{info}}
MKO 31.1 14 Since {{formcycle/}} interprets the original request URL of the user, especially when logging into a form, and this URL may not be determined correctly, it is necessary to configure intermediate servers accordingly. Make sure that both the HTTP header //Host// and the protocol used (//HTTP //or //HTTPS//) are forwarded unchanged. Also, the correct forwarding of WebSocket connections must be provided. Alternatively to the concret protocols, the intermediate server can also use //X-Forwarded// headers to indicate which protocol the request used originally.
MKO 17.1 15 {{/info}}
16
MKO 31.1 17 == Example configuration Apache ==
MKO 8.2 18
MKO 31.1 19 For the correct configuration of an Apache server, which acts as a reverse proxy, three points are relevant and have to be stored e.g. in the configuration of the VirtualHosts:
MKO 16.1 20
MKO 31.1 21 1. The instruction {{code language="none"}}ProxyPreserveHost On{{/code}} to get the originally called //Host// header
22 1. The separation of the individual protocols and its usage when forwarding to the application server. This means that for //HTTP// and //HTTPS// a separate VirtualHost with appropriate configuration must be used.
23 1. Configuration of the conditional RewriteRule for the forwarding of WebSocket connections via WS and WSS. By default, FORMCYCLE uses the corresponding ports of the servlet container (WS port = HTTP port, WSS port = HTTPS port).
MKO 21.1 24
MKO 31.1 25 This configuration, as well as any settings that may be necessary when using self-generated certificates, is briefly illustrated here:
MKO 21.1 26
MKO 31.1 27 (((
MKO 19.1 28 {{code language="none"}}
MKO 14.1 29 <VirtualHost www.example.com:80>
MKO 8.2 30 ...
MKO 31.1 31 # Enables retention of the originally called host up to the application server.
MKO 12.1 32 ProxyPreserveHost On
MKO 8.2 33 ...
MKO 31.1 34 # Forwarding via HTTP
MKO 8.2 35 ProxyPass / http://192.168.0.1/
36 ProxyPassReverse / http://192.168.0.1/
MKO 28.1 37 ...
MKO 31.1 38 # Forwarding of websocket-connections via WS
MKO 28.1 39 RewriteEngine on
MKO 27.1 40 RewriteCond %{HTTP:Upgrade} websocket [NC]
41 RewriteCond %{HTTP:Connection} upgrade [NC]
42 RewriteRule ^/?(.*) "ws://192.168.0.1:80/$1" [P,L]
MKO 8.2 43 </VirtualHost>
MKO 16.1 44
MKO 12.1 45 <IfModule mod_ssl.c>
46 <VirtualHost www.example.com:443>
MKO 8.2 47 ...
48 SSLEngine on
MKO 12.1 49 SSLProxyEngine On
MKO 8.2 50 ...
MKO 31.1 51 # Enables retention of the originally called host up to the application server.
MKO 8.2 52 ProxyPreserveHost On
MKO 16.1 53
MKO 31.1 54 # Deactivates the certificate check of the application server if necessary.
55 # Necessary if the certificates are self-created.
MKO 8.2 56 SSLProxyVerify none
57 SSLProxyCheckPeerCN off
58 SSLProxyCheckPeerName off
59 SSLProxyCheckPeerExpire off
60 ...
MKO 31.1 61 # Forwarding via HTTPS
MKO 8.2 62 ProxyPass / https://192.168.0.1/
63 ProxyPassReverse / https://192.168.0.1/
MKO 28.1 64 ...
MKO 31.1 65 # Forwarding of websocket-connections via WSS
MKO 28.1 66 RewriteEngine on
MKO 27.1 67 RewriteCond %{HTTP:Upgrade} websocket [NC]
68 RewriteCond %{HTTP:Connection} upgrade [NC]
69 RewriteRule ^/?(.*) "wss://192.168.0.1:443/$1" [P,L]
MKO 8.2 70 </VirtualHost>
MKO 14.1 71 </IfModule>
72 {{/code}}
MKO 31.1 73 )))
gru 25.9 74
MKO 31.1 75 == Usage of //X-Forwarded// headers for unencrypted communication ==
gru 25.9 76
MKO 31.1 77 If the intermediate server supports sending //X-Forwarded// headers and the servlet container which hosts {{formcycle/}} can evaluate these headers, the communication between the intermediate server and {{formcycle/}} can also be done via another protocol. Both the intermediate server and the servlet container must be configured to use these headers. For more information on configuration, refer to the documentation of the respective product.
gru 25.9 78
MKO 31.1 79 === Configuration examples ===
gru 25.9 80
MKO 31.1 81 With //Apache//, for example, the following configuration inside the responsible //VirtualHost//s can be used to include the appropriate headers:
gru 25.9 82
83 {{code language="none"}}
MKO 26.1 84 //HTTP
85 RequestHeader set X-Forwarded-Port "80"
86 RequestHeader set X-Forwarded-Proto "http"
87
88 //HTTPS
89 RequestHeader set X-Forwarded-Port "443"
90 RequestHeader set X-Forwarded-Proto "https"
91 {{/code}}
92
MKO 31.1 93 With //nginx//, for example, the following configuration can be used to send the corresponding headers in the section responsible for the reverse proxy:
MKO 26.1 94
95 {{code language="none"}}
gru 25.9 96 proxy_pass http://127.0.0.1:8080/formcycle/;
97 proxy_set_header Host $http_host;
98 proxy_set_header x-real-ip $remote_addr;
99 proxy_set_header x-forwarded-proto $scheme;
100 {{/code}}
gru 25.10 101
MKO 31.1 102 For //Apache Tomcat// servers, the following valve entry must be added to the {{code language="none"}}server.xml{{/code}} within the //catalina// engine to evaluate the sent //X-Forwarded// headers:
gru 25.9 103
104 {{code language="none"}}
105 <Engine......
106 <Valve className="org.apache.catalina.valves.RemoteIpValve"
107 remoteIpHeader="x-forwarded-for"
108 protocolHeader="x-forwarded-proto"
109 protocolHeaderHttpsValue="https" />
110 </Engine>
111 {{/code}}

Navigation

Copyright 2000-2024