DO NOT REPLY [Bug 25444] New: - ProxyPassReverse always rewrites redirects to same scheme as request

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=25444>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=25444

ProxyPassReverse always rewrites redirects to same scheme as request

           Summary: ProxyPassReverse always rewrites redirects to same
                    scheme as request
           Product: Apache httpd-2.0
           Version: 2.0.47
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: mod_proxy
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: manfred.duchrow@daedalos.com
                CC: manfred.duchrow@daedalos.com


When Apache/mod_proxy is used as a reverse proxy and directed with 
ProxyPassReverse to alter the Location header of a redirect, it always 
replaces the URL's scheme with that of the initial request. 
This happens because ap_proxy_location_reverse_map() 
in 'proxy_http.c' calls ap_construct_url() from 'core.c' to build 
the URL after changing the hostname and path, and ap_construct_url() gets 
the scheme from the ap_http_method macro.

This prevents, in the most likely example, redirection from an insecure 
to a secure URL.

BTW: This bug was posted for Apache 1.3.22 a long time ago.
See http://archive.apache.org/gnats/8696
It also contains a suggestion for a fix.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org