How to switch to/from HTTPS using Apache as a proxy to Tomcat

Posted on by

I’m writing this down because it too me an age to figure out a way of doing this. I have a website which Tomcat is happily serving. Areas of the site require a secure connection so I’m using Spring security to require particular URLs to be accessed over HTTPS. It means that when I access http://example.org:8080/webapp/login, it’ll bump me to https://example.org:8443/webapp/login. Note: Tomcat is setup with the SSL connector and a self signed .keystore see (http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html).

I have two vhosts setup in Apache, one for the http://example.org and one for https://example.org. They are both using mod_proxy to ProxyPass and ProxyPassReverse requests to the appropriate Tomcat URL’s. The problem comes when switching to HTTPS from HTTP and vice versa. Ideally I wanted some sort of ProxyPassReverse declaration in my config for http://example.org what would change HTTP headers (that Spring sets) for https://example.org:8443/webapp into https://example.org. Except ProxyPassReverse doesn’t work like that.

Now, I realise I could simply not use Spring to manage which parts of the site should be accessed over HTTPS and which should not…and just setup Apache to redirect as appropriate. I don’t want to do that though, because that makes the task of adding these restrictions a deploy time task, rather than a development time task. I don’t want to risk someone forgetting to add new restrictions when deploying the webapp and I’d much rather the developer added these restrictions when they were working on the task and really thinking about where and when they are needed.

So, how do I solve the problem so that the app can manage its secure-ness and I can setup Apache once and forget about it? The answer is to ProxyPassReverse onto a “special” URL, which when accessed will redirect to the HTTPS (or HTTP) site. For example, if the HTTP site needed to redirect to the HTTPS site, I’d add rules like so to perform the redirect:

    # Proxy a request (from the server) to switch to https onto a special URL "/2https/"
    ProxyPassReverse /2https/ https://example.org:8443/webapp/

    # When a client requests a URL prefixed with "/2https" map it onto the secure site
    RewriteRule ^/2https/(.*)$ https://example.org/$1 [R,L]

…and you’d add something similar to the secure site Apache config. As long as I don’t mount any pages at /2http or /2https I should be ok. Note a couple of things:

  • You’ll need “SSLProxyEngine on” and “RewriteEngine on” and obviously the appropriate Apache modules loaded for these commands.
  • Because of the redirect between HTTP <-> HTTPS you won’t be able to POST data between them directly (I’m not sure why you’d NEED to though)
  • Obviously you’ll need to setup Apache with an SSL certificate…but that is a different story

I should say a special thanks to this random site – from whence the idea actually came from. If anyone has any better ideas on how to do it I’d love to hear them. Please comment below.

12,044 thoughts on “How to switch to/from HTTPS using Apache as a proxy to Tomcat”

  2. Hi there all here every person is sharing these kinds of knowledge so its good to read this website and I used to pay a quick visit this webpage everyday. Sweet Bonanza

  7. This website truly has all the info I wanted concerning this subject and didnt know who to ask. Sweet Rush Bonanza

  13. Everything is very open with a really clear description of the challenges.
    It was really informative. Your website is useful. Thank you
    for sharing!

  15. Hiya! I know this is kinda off topic but I’d figured I’d ask.
    Would you be interested in trading links or maybe guest authoring a blog post or vice-versa?
    My site addresses a lot of the same subjects as yours and I feel we could greatly benefit from
    each other. If you might be interested feel free to send me an e-mail.
    I look forward to hearing from you! Great blog by the way!

  19. Nice post. I learn something totally new and challenging on blogs I stumbleupon everyday.
    It will always be interesting to read content from other authors and use a little something
    from other web sites.

  21. A person essentially help to make seriously
    articles I would state. This is the very first time I frequented
    your web page and so far? I amazed with the research you made to create this actual put up amazing.
    Great job!

  22. بهصورت جمع‌بندی

    برای کاربرانی که دنبال تجربه هستن

    بازی‌های جایزه‌دار

    مشغولن

    این مرجع

    کاملاً می‌تونه

    کمک‌کننده باشه

    یه نکته مهم اینه که

    اسم‌هایی مثل

    دامنه enfejaronline

    و

    ѕibbet آنلاین

    جایگاه خوبی دارن

    در آخر کار

    جذاب بود

    و

    بدون شک

    دوباره نگاهش می‌کنم

    Hｅre is my web bⅼoɡ; کار در منزل

  27. whoah this weblog is magnificent i love studying your articles.

    Keep up the great work! You already know, lots
    of persons are hunting round for this information, you can help them greatly.

  34. I know this if off topic but I’m looking
    into starting my own weblog and was curious what all
    is needed to get setup? I’m assuming having a blog like yours would
    cost a pretty penny? I’m not very web smart so I’m not 100%
    sure. Any recommendations or advice would be
    greatly appreciated. Appreciate it

  47. به شکل کلی

    برای کسایی که دنبال

    بازی انفجار

    در این حوزه فعالیت دارن

    این آدرس

    می‌تونه یکی از گزینه‌ها باشه

    انتخاب قابل قبولی باشه

    همچنین

    برندهای شناخته‌شده‌ای مثل

    دامنه ｅnfejaronline

    و

    sibbet جدید

    هم در این حوزه فعال هستن

    در جمع‌بندی

    برام جالب بود

    و

    بدون شک

    میام سراغش

    Ϝeel ree to visit my Ƅlog: سایت رسمی معتبر (Robbie)

  49. درود، بنده اخیرا وسط وبگردیدر اینترنت با
    این وبسایت رسیدم و بدون اغراق نظرم رو جلب کرد.
    نوشته‌هاش خیلی کامل بود و کمتر همچین منبعی ببینم.

    فکر کنم برای افراد مختلف ارزش دیدن داره.
    برای کسایی که دنبال اطلاعات کامل هستن حتما سر
    بزنن. در کل خوشم اومد و احتمالا دوباره استفاده می‌کنم

    به شکل خلاصه

    برای کسایی که قصد شروع دارن

    بازی‌های کازینویی

    فعالیت دارن

    این سایت

    به سادگی می‌تونه

    انتخاب درستی باشه

    نکته مثبت اینه که

    پروژه‌هایی مثل

    enfejɑronline محبوب

    و

    sibbet شناخته شده

    پیشرفت قابل توجهی داشتن

    در پایان کار

    تجربه مثبتی داشتم

    و

    حتما

    مراجعه مجدد دارم

    .

    Also visit my site … بازاریابی اینترنتی

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>