You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2016/04/07 13:59:23 UTC
[Bug 59285] New: Digitaly sign header when forwarding request
https://bz.apache.org/bugzilla/show_bug.cgi?id=59285
Bug ID: 59285
Summary: Digitaly sign header when forwarding request
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: mod_proxy
Assignee: bugs@httpd.apache.org
Reporter: david.naramski@nowina.lu
It could be great to have some "signature capabilities" in the proxy.
The typical scenario would be :
1) Apache is a reverse proxy and receive a request
2) Apache add a header (like REMOUTE_USER)
3) Apache use a private key to sign the headers specified and put this value in
a new header (like HEADERS_SIGNATURE).
4) Target server behind reverse proxy can now trust the request and the header
Configuration could be
HeaderSignatureTarget REMOTE_USER
HeaderSignatureStored REMOTE_USER_SIGNATURE
HeaderSignatureAlgorithm SHA1withRSA
HeaderSignaturePrivateKey file.pem
This means the that the apache will first evaluate the REMOTE_USER and sign
this with the private key stored in file.pem using the algorithm SHA1withRSA.
The header REMOTE_USER_SIGNATURE will be added to the forwarded request.
This could be a simple and efficient way of binding the reverse proxy to the
target application server.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59285] Digitaly sign header when forwarding request
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59285
David Naramski <da...@nowina.lu> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |WONTFIX
--- Comment #4 from David Naramski <da...@nowina.lu> ---
You are right, my request is completely redundant with this mechanism.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59285] Digitaly sign header when forwarding request
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59285
Yann Ylavic <yl...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |enhancement
--- Comment #1 from Yann Ylavic <yl...@gmail.com> ---
mod_proxy can already encrypt and authenticate the whole connection with the
backend using TLS.
Signing individual headers looks redundant...
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59285] Digitaly sign header when forwarding request
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59285
--- Comment #3 from Yann Ylavic <yl...@gmail.com> ---
(In reply to David Naramski from comment #2)
> I know that it is possible to use HTTPS but with this mechanism, the Reverse
> Proxy is not authentified.
Actually https allows client (mutual) authentication by requiring a client
certificate on the backend side (see
SSLProxyMachineCertificateFile/ChainFile/Path for the mod_proxy side).
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 59285] Digitaly sign header when forwarding request
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59285
--- Comment #2 from David Naramski <da...@nowina.lu> ---
(In reply to Yann Ylavic from comment #1)
> mod_proxy can already encrypt and authenticate the whole connection with the
> backend using TLS.
> Signing individual headers looks redundant...
I want to protect the communication between the reverse proxy and the target
server.
I was not aware that it was possible to use mod_proxy to initiate a SSL Mutual
Authentication between Apache and the target server. Do you confirm it is
possible?
I know that it is possible to use HTTPS but with this mechanism, the Reverse
Proxy is not authentified.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org