You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Alan AZZERA <az...@gmail.com> on 2007/10/19 13:54:07 UTC
[users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Hi world !
Here is my problem, I hope someone could help me.
I need to host some web apps, coded in PHP by non-professional developpers,
and sometimes poorly written and designed. I use an Apache server configured
as a Reverse Proxy, my real HTTP server is behind this R.P. I have two DNS
zones, a public one and a private one. Here is the chain :
1. Client's web browser asks for http://app.public.zone/
2. My Apache RP has a Virtual Host (ServerName app.public.zone) that
catches the request, and (reverse)proxifies it to
http://app.private.zone/
3. My Apache private server has a VirtualHost (Servername
app.private.zone) that handles the request.
Everything works fine with well coded and designed PHP apps, that make use
of right Apache environment variables like HTTP_X_FORWARDED_(HOST|SERVER).
But apps that make use of SCRIPT_URI, SERVER_NAME or HTTP_HOST cause
troubles. I tried to handle these troubles with mod_proxy_html, but I failed
to configure it to rewrite efficiently URL in CSS or JavaScripts. Desperate,
I tried to handle this with mod_rewrite and its [E=HTTP_HOST:
app.public.zone] feature in the VirtualHost app.private.zone. It failed too.
Do I miss something obvious ? Am I trying to solve problems the wrong way ?
Since I am not far for being just a newbie, it is very possible... Would
anyone be keen enough to put me on the right way ?
Best regards,
Al.
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Christian Folini <ch...@post.ch>.
On Mon, Oct 22, 2007 at 11:06:29PM +0200, Alan AZZERA wrote:
> Seems to be the same idea you describe, but with more flexibility &
> robustness - thanks to real DNS records.
Same idea, yes. But I would not exactly call it robust in
the sense of the KISS principle. I think it is never a good
idea two have two machines with different functions
share an identity. If you can work with the host header,
that is much safer much more error prone (but on apache
1.3 you had no choice as it did not have mod_headers.)
regs,
Christian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Sander Temme <sc...@apache.org>.
On Oct 22, 2007, at 2:06 PM, Alan AZZERA wrote:
> I thought about another approach : leaving as is my public DNS zone,
> and modifying my private one to distribute private IP for public
> domain names. My Reverse Proxies have just to be taught to use the
> private DNS, and all I have to do is to configure the VH
Have you considered writing a module that executes on the request_rec
after it gets read and munges the request data so that your PHP
scipts do the Right Thing (albeit perhaps for the wrong reasons)?
Alternatively, you could consider writing a PHP script that munges
the request and then set it to be included before any of the 'bad'
scripts run. I know you can do that from php.ini, but don't recall
where exactly. Exercise left for the reader. (:
For Redirect Responses, there is ProxyPassReverse which rewrites
Location: headers in 30x responses. It leaves the bodies alone, but
most clients act on the headers alone and follow the Redirect.
However, I understand that 30x responses are not your problem.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Alan AZZERA <az...@gmail.com>.
'nite
I'll try your tips tomorrow. Thanks a lot.
> If you want to get your hands really dirty, you can also
> leave mod_headers aside and set www.example.com statically
> in /etc/hosts to point to the backend. That way the proxy
> server will still believe that he is www.example.com via
> servername, but when you proxy to www.example.com it will
> go to the backend via /etc/hosts with the right host-header
> to let the backend generate the correct URLs. Not that I
> would recommend it, but I have seen this in practice...
I thought about another approach : leaving as is my public DNS zone,
and modifying my private one to distribute private IP for public
domain names. My Reverse Proxies have just to be taught to use the
private DNS, and all I have to do is to configure the VH
app.public.zone with ProxyPass / app.public.zone, app.public.zone
being resolved to the IP app.private.zone had previously.
Seems to be the same idea you describe, but with more flexibility &
robustness - thanks to real DNS records.
Anothet thanks. Regards,
Al.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Christian Folini <ch...@post.ch>.
On Fri, Oct 19, 2007 at 09:09:54PM +0200, Alan AZZERA wrote:
> > RewriteRule /(.*) http://backend/$1 [proxy,last]
>
> But AFAIK, mod_rewrite cannot alter anything *inside* the HTML code
> going out the server. mod_proxy_html can...
yep.
> I'm currently trying to deal with PMWiki. It uses only HTTP_HOST. The
> problem with this application is that developpers use HTTP_HOST to
> construct absolute URL everywhere in the HTML code their PHP generate,
> even in CSS and Scripts. Pfouark !
Typical behaviour.
Try to do it the following way with mod_proxy, mod_rewrite and
mod_headers.
RewriteRule /(.*) http://backend/$1 [proxy,last]
<Proxy ...>
RequestHeader set Host "www.example.com"
...
This should trick your wiki to use www.example.com to generate
the correct HTML code without the need to rewrite the response.
If you want to get your hands really dirty, you can also
leave mod_headers aside and set www.example.com statically
in /etc/hosts to point to the backend. That way the proxy
server will still believe that he is www.example.com via
servername, but when you proxy to www.example.com it will
go to the backend via /etc/hosts with the right host-header
to let the backend generate the correct URLs. Not that I
would recommend it, but I have seen this in practice...
regs,
Christian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Alan AZZERA <az...@gmail.com>.
> Proxying bad applications is a dirty business. They do not
> get any cleaner when they are told to behave nicely behind
> a proxy.
I'm afraid you're right...
> mod_rewrite has that too. When proxying with mod_rewrite it is
> a good practice to set that.
>
> RewriteRule /(.*) http://backend/$1 [proxy,last]
But AFAIK, mod_rewrite cannot alter anything *inside* the HTML code
going out the server. mod_proxy_html can...
> SERVER_NAME is not an environment variable...
> I do not know your apps, so I can not really tell, but many times
> setting the appropriate http header "Host" is enough.
I'm currently trying to deal with PMWiki. It uses only HTTP_HOST. The
problem with this application is that developpers use HTTP_HOST to
construct absolute URL everywhere in the HTML code their PHP generate,
even in CSS and Scripts. Pfouark !
Anyway, colleagues reported to me use of SERVER_NAME in other apps...
I've just forgotten their names.
> You must have messed your requests completely on the proxy. OR
> something similar. I suggest you run tcpdump (tcpdump -A -s 0 port 8080)
> or something similar between the two and dump the traffic for
> debugging.
Thanks for your tips, I will investigate. Seems to be no clean and
simple solution.
Regard,
Al.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Christian Folini <ch...@post.ch>.
hya,
On Fri, Oct 19, 2007 at 03:32:37PM +0200, Alan AZZERA wrote:
> I ran into such awful hacks with mod_proxy_html.
Proxying bad applications is a dirty business. They do not
get any cleaner when they are told to behave nicely behind
a proxy.
> IMHO... It could be efficient, but it was impossible to quit the chain
> of rewriting rules at the first match, resulting in ugly rewritings,
> ans possibly infinite loops ! mod_proxy_html had though a "L" flag
> (see http://apache.webthing.com/mod_proxy_html/config.html), which
> action is supposed to be 'If this rule matches, no more rules are
> applied". But it didn't work with the packages available in my Etch
> server...
mod_rewrite has that too. When proxying with mod_rewrite it is
a good practice to set that.
RewriteRule /(.*) http://backend/$1 [proxy,last]
> You're right : with "RequestHeader set HOST app.private.zone", I can
> alter the HTTP_HOST Apache environment variable. But I don't know how
> to alter variables like SERVER_NAME.
SERVER_NAME is not an environment variable...
I do not know your apps, so I can not really tell, but many times
setting the appropriate http header "Host" is enough.
> Anyway, I get what I want, but it doesn't help : it gets my RP
> confused. It now returns :
> Proxy Error
> The proxy server received an invalid response from an upstream server.
> The proxy server could not handle the request GET /app/somepage.php.
> Reason: Error reading from remote server
You must have messed your requests completely on the proxy. OR
something similar. I suggest you run tcpdump (tcpdump -A -s 0 port 8080)
or something similar between the two and dump the traffic for
debugging.
good luck,
christian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Alan AZZERA <az...@gmail.com>.
Hi !
Thanks for answering...
> You are facing a very typical problem.
Undoubtly ;) !
> I am not proficient with mod_proxy_html, so I am not sure I can help you.
> However, the est way is always to go and fix the application.
It's such a pain ! There are plenty of well-designed apps, but far
more poorly written ones !
> If you can not do that for whatever reason, then mod_proxy_html is a good approach.
> A more general approach is to work with mod_ext_filter.
> See http://httpd.apache.org/docs/2.0/mod/mod_ext_filter.html
I haven't heard about it. Thanks for the clue...
> It has some nice examples. Needless to say, that this
> is performance relevant
I have rather rough servers to handle reverse-proxyfication : two
dual-core Xeon @ 2 GHz with 2 GB RAM. They mostly sleep ;) !
> and that this is evolving
> into not very elegant hack.
I ran into such awful hacks with mod_proxy_html. Not a good approach,
IMHO... It could be efficient, but it was impossible to quit the chain
of rewriting rules at the first match, resulting in ugly rewritings,
ans possibly infinite loops ! mod_proxy_html had though a "L" flag
(see http://apache.webthing.com/mod_proxy_html/config.html), which
action is supposed to be 'If this rule matches, no more rules are
applied". But it didn't work with the packages available in my Etch
server...
> I am not sure I understand what you are trying to
> achieve with E=HTTP_HOST... In order to get this to your
> application, you will have to set the http host header
> explicitely with mod_header.
You're right : with "RequestHeader set HOST app.private.zone", I can
alter the HTTP_HOST Apache environment variable. But I don't know how
to alter variables like SERVER_NAME.
Anyway, I get what I want, but it doesn't help : it gets my RP
confused. It now returns :
Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /app/somepage.php.
Reason: Error reading from remote server
Let me explain what I was trying to do : alter the variables dumb apps
rely on, to set them a way that make these apps work behind a RP
without any patch or cryptic regexp.
Thanks & regards,
Al.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Need help to deal with poorly written PHP apps behind Apache used as Reverse Proxy
Posted by Christian Folini <ch...@post.ch>.
Hey Alan,
You are facing a very typical problem. I am not proficient
with mod_proxy_html, so I am not sure I can help you.
However, the best way is always to go and fix the
application. If you can not do that for whatever
reason, then mod_proxy_html is a good approach. A
more general approach is to work with mod_ext_filter.
See http://httpd.apache.org/docs/2.0/mod/mod_ext_filter.html
It has some nice examples. Needless to say, that this
is performance relevant and that this is evolving
into not very elegant hack.
I am not sure I understand what you are trying to
achieve with E=HTTP_HOST... In order to get this to your
application, you will have to set the http host header
explicitely with mod_header.
regs,
Christian
On Fri, Oct 19, 2007 at 01:54:07PM +0200, Alan AZZERA wrote:
> Hi world !
>
> Here is my problem, I hope someone could help me.
>
> I need to host some web apps, coded in PHP by non-professional developpers,
> and sometimes poorly written and designed. I use an Apache server configured
> as a Reverse Proxy, my real HTTP server is behind this R.P. I have two DNS
> zones, a public one and a private one. Here is the chain :
>
> 1. Client's web browser asks for http://app.public.zone/
> 2. My Apache RP has a Virtual Host (ServerName app.public.zone) that
> catches the request, and (reverse)proxifies it to
> http://app.private.zone/
> 3. My Apache private server has a VirtualHost (Servername
> app.private.zone) that handles the request.
>
> Everything works fine with well coded and designed PHP apps, that make use
> of right Apache environment variables like HTTP_X_FORWARDED_(HOST|SERVER).
> But apps that make use of SCRIPT_URI, SERVER_NAME or HTTP_HOST cause
> troubles. I tried to handle these troubles with mod_proxy_html, but I failed
> to configure it to rewrite efficiently URL in CSS or JavaScripts. Desperate,
> I tried to handle this with mod_rewrite and its [E=HTTP_HOST:
> app.public.zone] feature in the VirtualHost app.private.zone. It failed too.
>
> Do I miss something obvious ? Am I trying to solve problems the wrong way ?
> Since I am not far for being just a newbie, it is very possible... Would
> anyone be keen enough to put me on the right way ?
>
> Best regards,
>
> Al.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org