You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Mike Lyon <mi...@gmail.com> on 2009/04/01 05:10:39 UTC
[users@httpd] mod_rewrite on reverse proxies...
Howdy All,
Is anyone out there using mod_rewrite to rewrite URLs that pass through
their reverse proxies? I am using Apache as an SSL offloader for some web /
app servers that sit behind it. I have it up and working great. The only
problem is that the app will return to the client (via the reverse-proxy of
course) HTML that includes hrefs to itself that point to "
http://app1.example.com" not "https://app1.example.com."
So when the client gets this HTML and wants to get content from the href it
was just given from the app server, it wants to connect back to the proxy
via http, not https. This defies the whole reason why we are doing SSL.
So what I would like to know is if there is a way I can rewrite those hrefs
when they go from the server to the client with mod_rewrite so the client is
pointed to an SSL href and not just a regular http href. Is something that
mod_rewrite is capable of doing?
Thank You,
Mike
Re: [users@httpd] mod_rewrite on reverse proxies...
Posted by André Warnier <aw...@ice-sa.com>.
Sorry, below I meant mod_proxy, not mod_rewrite.
André Warnier wrote:
> Mike Lyon wrote:
> ...
>
>>
>> So what I would like to know is if there is a way I can rewrite those
>> hrefs
>> when they go from the server to the client with mod_rewrite so the
>> client is
>> pointed to an SSL href and not just a regular http href. Is something
>> that
>> mod_rewrite is capable of doing?
>>
> mod_rewrite only deals with HTTP headers, not the content.
> You probably need to parse/filter the content which you return and
> modify these URLs on-the-fly.
> There exists a module to do that, but I forget its name. ProxyHtml ?
> In simple cases, there is another module that could help, working more
> like sed. I also forget its name, but you could try looking for
> mod_replace.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_rewrite on reverse proxies...
Posted by André Warnier <aw...@ice-sa.com>.
Mike Lyon wrote:
...
>
> So what I would like to know is if there is a way I can rewrite those hrefs
> when they go from the server to the client with mod_rewrite so the client is
> pointed to an SSL href and not just a regular http href. Is something that
> mod_rewrite is capable of doing?
>
mod_rewrite only deals with HTTP headers, not the content.
You probably need to parse/filter the content which you return and
modify these URLs on-the-fly.
There exists a module to do that, but I forget its name. ProxyHtml ?
In simple cases, there is another module that could help, working more
like sed. I also forget its name, but you could try looking for mod_replace.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_rewrite on reverse proxies...
Posted by John Armstrong <ja...@bepress.com>.
You wouldn't specify anything, they would adopt the requesting scope.
This lets the browser deal with it. So '/relativeurl.html' is returned
to the browser and the browser appends the full URL based on the page
its being requested in.
The only time this gets weird is when you need to enforce SSL and you
can do this in mod_rewrite for specific URLs or check headers on the
request on the back-end and issue an external redirect (I think
mod-proxy appends some ssl specific headers you can key from but its
been awhile).
But relative is the way to go for ease of development, load balancing
and transparency.
John-
On Wed, Apr 1, 2009 at 10:47 AM, Mike Lyon <mi...@gmail.com> wrote:
> That would be the best thing to do.
>
> Please excuse my ignorance though. If the hrefs were written in relative,
> would you still specify the http or https in the string? Or would you not
> include those?
>
> Thanks,
> Mike
>
>
> On Wed, Apr 1, 2009 at 10:43 AM, John Armstrong <ja...@bepress.com>
> wrote:
>>
>> We use relative url's to bypass this issue.
>>
>> It also prevents other 'backend URL leakage' and generally allows for
>> proper load balancing without having to write software alter your
>> display output.
>>
>> John-
>>
>> On Tue, Mar 31, 2009 at 11:36 PM, Krist van Besien
>> <kr...@gmail.com> wrote:
>> > On Wed, Apr 1, 2009 at 5:10 AM, Mike Lyon <mi...@gmail.com> wrote:
>> >> Howdy All,
>> >>
>> >> Is anyone out there using mod_rewrite to rewrite URLs that pass through
>> >> their reverse proxies? I am using Apache as an SSL offloader for some
>> >> web /
>> >> app servers that sit behind it. I have it up and working great. The
>> >> only
>> >> problem is that the app will return to the client (via the
>> >> reverse-proxy of
>> >> course) HTML that includes hrefs to itself that point to
>> >> "http://app1.example.com" not "https://app1.example.com."
>> >
>> > The preferred solution is to configure your webapp servers so that
>> > they use the proper hostnames (ie. that of your front end server) in
>> > the URLs they generate, or that they generate relative URLs. This
>> > should usually be possible.
>> > I'd first try this, as any other solution will be more complicated and
>> > has higher admin overhead.
>> >
>> > If that is not possible have a look at mod_proxy_html. This is the
>> > only module I know of that will rewrite HTML contents. mod_rewrite and
>> > mod_proxy will not do this.
>> >
>> > Krist
>> >
>> > --
>> > krist.vanbesien@gmail.com
>> > krist@vanbesien.org
>> > Bremgarten b. Bern, Switzerland
>> > --
>> > A: It reverses the normal flow of conversation.
>> > Q: What's wrong with top-posting?
>> > A: Top-posting.
>> > Q: What's the biggest scourge on plain text email discussions?
>> >
>> > ---------------------------------------------------------------------
>> > The official User-To-User support forum of the Apache HTTP Server
>> > Project.
>> > See <URL:http://httpd.apache.org/userslist.html> for more info.
>> > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> > " from the digest: users-digest-unsubscribe@httpd.apache.org
>> > For additional commands, e-mail: users-help@httpd.apache.org
>> >
>> >
>>
>>
>>
>> --
>> John Armstrong
>> Vice President, Engineering
>> The Berkeley Electronic Press
>> 510/665-1200 x160
>> http://www.bepress.com/
>>
>> bepress: 10 years of accelerating and enhancing the flow of scholarly
>> ideas
>>
>> ---------------------------------------------------------------------
>> The official User-To-User support forum of the Apache HTTP Server Project.
>> See <URL:http://httpd.apache.org/userslist.html> for more info.
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>
>
--
John Armstrong
Vice President, Engineering
The Berkeley Electronic Press
510/665-1200 x160
http://www.bepress.com/
bepress: 10 years of accelerating and enhancing the flow of scholarly ideas
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_rewrite on reverse proxies...
Posted by Mike Lyon <mi...@gmail.com>.
That would be the best thing to do.
Please excuse my ignorance though. If the hrefs were written in relative,
would you still specify the http or https in the string? Or would you not
include those?
Thanks,
Mike
On Wed, Apr 1, 2009 at 10:43 AM, John Armstrong <ja...@bepress.com>wrote:
> We use relative url's to bypass this issue.
>
> It also prevents other 'backend URL leakage' and generally allows for
> proper load balancing without having to write software alter your
> display output.
>
> John-
>
> On Tue, Mar 31, 2009 at 11:36 PM, Krist van Besien
> <kr...@gmail.com> wrote:
> > On Wed, Apr 1, 2009 at 5:10 AM, Mike Lyon <mi...@gmail.com> wrote:
> >> Howdy All,
> >>
> >> Is anyone out there using mod_rewrite to rewrite URLs that pass through
> >> their reverse proxies? I am using Apache as an SSL offloader for some
> web /
> >> app servers that sit behind it. I have it up and working great. The only
> >> problem is that the app will return to the client (via the reverse-proxy
> of
> >> course) HTML that includes hrefs to itself that point to
> >> "http://app1.example.com" not "https://app1.example.com."
> >
> > The preferred solution is to configure your webapp servers so that
> > they use the proper hostnames (ie. that of your front end server) in
> > the URLs they generate, or that they generate relative URLs. This
> > should usually be possible.
> > I'd first try this, as any other solution will be more complicated and
> > has higher admin overhead.
> >
> > If that is not possible have a look at mod_proxy_html. This is the
> > only module I know of that will rewrite HTML contents. mod_rewrite and
> > mod_proxy will not do this.
> >
> > Krist
> >
> > --
> > krist.vanbesien@gmail.com
> > krist@vanbesien.org
> > Bremgarten b. Bern, Switzerland
> > --
> > A: It reverses the normal flow of conversation.
> > Q: What's wrong with top-posting?
> > A: Top-posting.
> > Q: What's the biggest scourge on plain text email discussions?
> >
> > ---------------------------------------------------------------------
> > The official User-To-User support forum of the Apache HTTP Server
> Project.
> > See <URL:http://httpd.apache.org/userslist.html> for more info.
> > To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> > " from the digest: users-digest-unsubscribe@httpd.apache.org
> > For additional commands, e-mail: users-help@httpd.apache.org
> >
> >
>
>
>
> --
> John Armstrong
> Vice President, Engineering
> The Berkeley Electronic Press
> 510/665-1200 x160
> http://www.bepress.com/
>
> bepress: 10 years of accelerating and enhancing the flow of scholarly ideas
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] mod_rewrite on reverse proxies...
Posted by John Armstrong <ja...@bepress.com>.
We use relative url's to bypass this issue.
It also prevents other 'backend URL leakage' and generally allows for
proper load balancing without having to write software alter your
display output.
John-
On Tue, Mar 31, 2009 at 11:36 PM, Krist van Besien
<kr...@gmail.com> wrote:
> On Wed, Apr 1, 2009 at 5:10 AM, Mike Lyon <mi...@gmail.com> wrote:
>> Howdy All,
>>
>> Is anyone out there using mod_rewrite to rewrite URLs that pass through
>> their reverse proxies? I am using Apache as an SSL offloader for some web /
>> app servers that sit behind it. I have it up and working great. The only
>> problem is that the app will return to the client (via the reverse-proxy of
>> course) HTML that includes hrefs to itself that point to
>> "http://app1.example.com" not "https://app1.example.com."
>
> The preferred solution is to configure your webapp servers so that
> they use the proper hostnames (ie. that of your front end server) in
> the URLs they generate, or that they generate relative URLs. This
> should usually be possible.
> I'd first try this, as any other solution will be more complicated and
> has higher admin overhead.
>
> If that is not possible have a look at mod_proxy_html. This is the
> only module I know of that will rewrite HTML contents. mod_rewrite and
> mod_proxy will not do this.
>
> Krist
>
> --
> krist.vanbesien@gmail.com
> krist@vanbesien.org
> Bremgarten b. Bern, Switzerland
> --
> A: It reverses the normal flow of conversation.
> Q: What's wrong with top-posting?
> A: Top-posting.
> Q: What's the biggest scourge on plain text email discussions?
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
--
John Armstrong
Vice President, Engineering
The Berkeley Electronic Press
510/665-1200 x160
http://www.bepress.com/
bepress: 10 years of accelerating and enhancing the flow of scholarly ideas
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_rewrite on reverse proxies...
Posted by Krist van Besien <kr...@gmail.com>.
On Wed, Apr 1, 2009 at 5:10 AM, Mike Lyon <mi...@gmail.com> wrote:
> Howdy All,
>
> Is anyone out there using mod_rewrite to rewrite URLs that pass through
> their reverse proxies? I am using Apache as an SSL offloader for some web /
> app servers that sit behind it. I have it up and working great. The only
> problem is that the app will return to the client (via the reverse-proxy of
> course) HTML that includes hrefs to itself that point to
> "http://app1.example.com" not "https://app1.example.com."
The preferred solution is to configure your webapp servers so that
they use the proper hostnames (ie. that of your front end server) in
the URLs they generate, or that they generate relative URLs. This
should usually be possible.
I'd first try this, as any other solution will be more complicated and
has higher admin overhead.
If that is not possible have a look at mod_proxy_html. This is the
only module I know of that will rewrite HTML contents. mod_rewrite and
mod_proxy will not do this.
Krist
--
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org