How to switch to/from HTTPS using Apache as a proxy to Tomcat

Posted on by

I’m writing this down because it too me an age to figure out a way of doing this. I have a website which Tomcat is happily serving. Areas of the site require a secure connection so I’m using Spring security to require particular URLs to be accessed over HTTPS. It means that when I access http://example.org:8080/webapp/login, it’ll bump me to https://example.org:8443/webapp/login. Note: Tomcat is setup with the SSL connector and a self signed .keystore see (http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html).

I have two vhosts setup in Apache, one for the http://example.org and one for https://example.org. They are both using mod_proxy to ProxyPass and ProxyPassReverse requests to the appropriate Tomcat URL’s. The problem comes when switching to HTTPS from HTTP and vice versa. Ideally I wanted some sort of ProxyPassReverse declaration in my config for http://example.org what would change HTTP headers (that Spring sets) for https://example.org:8443/webapp into https://example.org. Except ProxyPassReverse doesn’t work like that.

Now, I realise I could simply not use Spring to manage which parts of the site should be accessed over HTTPS and which should not…and just setup Apache to redirect as appropriate. I don’t want to do that though, because that makes the task of adding these restrictions a deploy time task, rather than a development time task. I don’t want to risk someone forgetting to add new restrictions when deploying the webapp and I’d much rather the developer added these restrictions when they were working on the task and really thinking about where and when they are needed.

So, how do I solve the problem so that the app can manage its secure-ness and I can setup Apache once and forget about it? The answer is to ProxyPassReverse onto a “special” URL, which when accessed will redirect to the HTTPS (or HTTP) site. For example, if the HTTP site needed to redirect to the HTTPS site, I’d add rules like so to perform the redirect:

    # Proxy a request (from the server) to switch to https onto a special URL "/2https/"
    ProxyPassReverse /2https/ https://example.org:8443/webapp/

    # When a client requests a URL prefixed with "/2https" map it onto the secure site
    RewriteRule ^/2https/(.*)$ https://example.org/$1 [R,L]

…and you’d add something similar to the secure site Apache config. As long as I don’t mount any pages at /2http or /2https I should be ok. Note a couple of things:

  • You’ll need “SSLProxyEngine on” and “RewriteEngine on” and obviously the appropriate Apache modules loaded for these commands.
  • Because of the redirect between HTTP <-> HTTPS you won’t be able to POST data between them directly (I’m not sure why you’d NEED to though)
  • Obviously you’ll need to setup Apache with an SSL certificate…but that is a different story

I should say a special thanks to this random site – from whence the idea actually came from. If anyone has any better ideas on how to do it I’d love to hear them. Please comment below.

10,593 thoughts on “How to switch to/from HTTPS using Apache as a proxy to Tomcat”

  4. Давно искал где посмотреть — есть хороший ресурс с кино. Кино на выходные — специальная подборка фильмов для отдыха. Расслабьтесь после рабочей недели с хорошим фильмом. рейтинг фильмов Комедии для хорошего настроения триллеры для остроты ощущений — всё для идеального уикенда. Смотрите бесплатно Кому интересно вот ссылка — https://www.gorodpavlodar.kz/News_101652_3.html фильмы с субтитрами онлайнсмотреть новые фильмылучшие фильмы онлайн Надеюсь пригодится

  8. Great goods from you, man. I have bear in mind your stuff prior to and
    you’re simply too excellent. I actually like what you
    have obtained here, really like what you are stating and the best
    way wherein you assert it. You are making it enjoyable and you still care for to keep it
    smart. I cant wait to read much more from you.
    This is actually a terrific website.

  15. Как удержать внимание пользователя в цифровой среде и превратить посетителей в клиентов — читайте в статье: https://lefmun.ru/stati/prodvizhenie-sajtov-iskusstvo-privlechenija-vnimanija-v-cifrovom-mire/

  17. Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your
    point. You obviously know what youre talking about,
    why throw away your intelligence on just posting
    videos to your weblog when you could be giving us something enlightening to read?

  28. Alternatively, you can play it at Stake, a casino that boasts raving reviews from gamers and experts alike. You have numerous strategies to use and boost your fun, as long as you remember that none of them will influence the outcome. Furthermore, you can take advantage of our awesome promo codes at Stake, another great reason to pick Stake! The lack of long-term experience is no reason for underestimating their VIP bet offerings. NetEnt and Evolution Gaming have delivered their most luxurious and extravagant live streams of Live Roulette Pro and Blackjack Diamond VIP where you can enjoy a mind-blowing £75,000 maximum bet limit for roulette and a £10,000 one for blackjack. We get the chills by these numbers, but you are more than welcome to try if you dare. рџ’¬Our editor’s view: “If you’re looking for a premium live casino that invites you onto the casino floor of one of the UK’s top-rated land-based venues, The Vic is the one. Play live dealer games streamed from Grosvenor Casinos in London, Nottingham, Sheffield, and Glasgow, including roulette with multipliers of up to 500x. If that’s not enough, immerse yourself in the live game show lobby and play legendary titles like Deal or No Deal and Crazy Time.” 
    https://zoya.dreamfoodsind.com/jack-and-the-beanstalk-slot-cashback-bonus-a-players-review/
    Playing Lucky Penny demo is the best way for you to learn the game features before playing for real money in a real casino. © AllSlotsOnline.Casino 2019-2025 What are the tips on the best strategies for the casino? There are two ways to start playing Clover Tales for money on this page, Lady Jane. If you bet and lose, continued bravely to train horses from Warren Place and it says much about Abdullah that he allowed her to train Noble Mission. To claim, you need to be sufficiently bankrolled to weather the negative swings you may experience early on. All slot games are available to play in demo mode with virtual money However to win real money, because they bring a number of undeniable advantages. You can open it from the web browser, I find new entertainment. With one play remaining at the end of the first half of Super Bowl 43, Fantasy.

  30. For example, the odds of winning a single number bet playing European Roulette is 2.70%, while the same chances when playing American Roulette are only 2.63%. There are a few possible strategies to consider when playing Super Stake Roulette. As you can consider going for multipliers or betting on Super Stake. With the 64% roulette system, you place wagers on 2 of the 3 dozens. This means that in European roulette, you cover 24 out of 37 spots. The result of these bets is that you have a 64,8% possibility to win a round and a 35,2% chance to lose it. Let’s now see how the 64% system performs in 5 virtual spins. We pooled our best experts together and identified eight proven roulette strategies for new players who have yet to develop their own strategies. While nobody can ever guarantee a win, these tried and tested strategies are excellent tools that can increase your chances of online roulette success.
    https://alsconciergevoyage.com/playing-1win-online-game-uk-guide/
    Ready to test your luck? Experience Lucky Penny slots at Wolfbet today, utilizing our demo mode for risk-free exploration or diving directly into real money play with our secure crypto gaming platform. The gameplay of lucky penny slots introduces a captivating blend of mechanics that entice both seasoned players and newcomers. The following are fundamental elements you can expect when you step into this exciting world: Having issues with Lucky Penny ? To play Lucky Penny at an online casino, you’ll first need to find a reputable casino that offers 3 Oaks games. Once you’ve signed up and made a deposit, you can head to the slots section and search for Lucky Penny online slot. Simply load the game, choose your bet size, and start spinning. The game’s interface is user-friendly, so you’ll have no trouble finding your way around. You can adjust your bet size using the on-screen controls, and the game also offers an autoplay feature if you prefer to sit back and watch the reels spin automatically.

  49. Hello! This is my 1st comment here so I just wanted to give a quick shout out and tell you I really enjoy reading through your articles. Can you suggest any other blogs/websites/forums that deal with the same subjects? Thanks for your time!

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>