How to switch to/from HTTPS using Apache as a proxy to Tomcat

Posted on by

I’m writing this down because it too me an age to figure out a way of doing this. I have a website which Tomcat is happily serving. Areas of the site require a secure connection so I’m using Spring security to require particular URLs to be accessed over HTTPS. It means that when I access http://example.org:8080/webapp/login, it’ll bump me to https://example.org:8443/webapp/login. Note: Tomcat is setup with the SSL connector and a self signed .keystore see (http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html).

I have two vhosts setup in Apache, one for the http://example.org and one for https://example.org. They are both using mod_proxy to ProxyPass and ProxyPassReverse requests to the appropriate Tomcat URL’s. The problem comes when switching to HTTPS from HTTP and vice versa. Ideally I wanted some sort of ProxyPassReverse declaration in my config for http://example.org what would change HTTP headers (that Spring sets) for https://example.org:8443/webapp into https://example.org. Except ProxyPassReverse doesn’t work like that.

Now, I realise I could simply not use Spring to manage which parts of the site should be accessed over HTTPS and which should not…and just setup Apache to redirect as appropriate. I don’t want to do that though, because that makes the task of adding these restrictions a deploy time task, rather than a development time task. I don’t want to risk someone forgetting to add new restrictions when deploying the webapp and I’d much rather the developer added these restrictions when they were working on the task and really thinking about where and when they are needed.

So, how do I solve the problem so that the app can manage its secure-ness and I can setup Apache once and forget about it? The answer is to ProxyPassReverse onto a “special” URL, which when accessed will redirect to the HTTPS (or HTTP) site. For example, if the HTTP site needed to redirect to the HTTPS site, I’d add rules like so to perform the redirect:

    # Proxy a request (from the server) to switch to https onto a special URL "/2https/"
    ProxyPassReverse /2https/ https://example.org:8443/webapp/

    # When a client requests a URL prefixed with "/2https" map it onto the secure site
    RewriteRule ^/2https/(.*)$ https://example.org/$1 [R,L]

…and you’d add something similar to the secure site Apache config. As long as I don’t mount any pages at /2http or /2https I should be ok. Note a couple of things:

  • You’ll need “SSLProxyEngine on” and “RewriteEngine on” and obviously the appropriate Apache modules loaded for these commands.
  • Because of the redirect between HTTP <-> HTTPS you won’t be able to POST data between them directly (I’m not sure why you’d NEED to though)
  • Obviously you’ll need to setup Apache with an SSL certificate…but that is a different story

I should say a special thanks to this random site – from whence the idea actually came from. If anyone has any better ideas on how to do it I’d love to hear them. Please comment below.

12,034 thoughts on “How to switch to/from HTTPS using Apache as a proxy to Tomcat”

  3. With havin so much content do you ever run into any issues of plagorism or copyright violation? My website has a lot of exclusive content I’ve
    either authored myself or outsourced but it
    seems a lot of it is popping it up all over the internet
    without my permission. Do you know any solutions to help prevent content
    from being ripped off? I’d definitely appreciate it.

  6. What i don’t realize is in reality how you are no longer really a lot more
    neatly-preferred than you may be now. You are very intelligent.
    You know thus significantly when it comes to
    this topic, produced me for my part believe it from a lot of varied
    angles. Its like women and men don’t seem to be fascinated except it’s one thing to do with Girl gaga!

    Your own stuffs great. Always deal with it up!

  14. Awesome issues here. I am very satisfied to see your article.
    Thank you a lot and I am taking a look forward to touch you.

    Will you kindly drop me a e-mail?

  16. Oh my goodness! Awesome article dude! Many thanks, However I am encountering issues with your RSS.
    I don’t understand why I can’t join it. Is there anybody else getting the
    same RSS issues? Anyone that knows the solution can you kindly
    respond? Thanx!!

  17. در نهایت امر

    برای افرادی که قصد دارن

    بتینگ

    سرگرممیشن

    این سایت

    می‌تونه انتخاب مناسبی باشه

    گزینه قابل اعتمادی باشه

    نکته جالب اینهکه

    برندهایی مثل

    برند еnfejaronline

    و

    برند sibbet

    تونستن کاربرا جذب کنن

    در کل داستان

    قابل استفاده بود

    و

    حتما

    دوباره چکشمی‌کنم

    Takｅ a look at my website – یادگیری ماشین

  23. WOW just what I was searching for. Came here by searching for meta_keyword new online casino slot games

  26. Howdy I am so happy I found your webpage I really found you by accident while I was browsing on Askjeeve for something else Regardless I am here now and would just like to say thanks a lot for a fantastic post and a all round entertaining blog I also love the theme/design I don’t have time to go through it all at the minute but I have saved it and also included your RSS feeds so when I have time I will be back to read much more Please do keep up the great b. new online slots casino

  28. سلام، بنده اخیرا هنگام گشتن تو اینترنت به این سایت برخوردم و راستش رو بخواید
    خیلی خوشم اومد. نوشته‌هاش به‌دردبخور
    بود و کمتر همچین منبعی پیدا کنم.
    فکر کنم برای افراد مختلف مفید باشه.

    اگهدنبال یه سایت خوب هستن بد نیست
    سر بزنن. در مجموع خوشم اومد و احتمالا بازدیدش می‌کنم

    به شکل کلی

    برای اون دسته که

    فعالیت‌های شرطی

    مشغولن

    این سیستم آنلاین

    به خوبی می‌تونه

    انتخاب درستی باشه

    نکته قابل توجه اینه که

    نام‌هایی مثل

    enfeјar online

    و

    شبکه sibƅet

    هم در این حوزه فعال هستن

    در پایان کار

    مفید بود

    و

    احتمالاً

    دوباره استفاده می‌کنم

    .

    Feeⅼ free to visit my weƄ page – مرجع آموزشی

  29. For the reason that the admin of this website is working no hesitation very rapidly it will be famous due to its quality contents. best online casino slots for real money

  32. Особенно понравился раздел про Аналитика и новости валют: ваш гид.

    Вот, можете почитать:

    https://rubl24.ru

  33. Для тех, кто ищет информацию по теме “Обзор новостей топ-клубов и спорта на Мировой Гранд”, есть отличная статья.

    Вот, можете почитать:

    https://liverpoolnews.ru

  39. Hello there I am so thrilled I found your blog page, I really found you
    by accident, while I was browsing on Bing for
    something else, Anyhow I am here now and would just
    like to say many thanks for a incredible post and a all round exciting
    blog (I also love the theme/design), I don’t have time to
    go through it all at the minute but I have saved it and also
    added your RSS feeds, so when I have time I will be back to read a lot more, Please do keep up the fantastic job.

  42. Howdy very nice blog!! Man .. Excellent .. Superb .. I’ll bookmark your web site and take the feeds
    additionally? I’m glad to seek out numerous helpful information here within the publish,
    we need work out more techniques in this regard, thanks for sharing.
    . . . . .

  46. Hi there! I could have sworn I’ve been to this website before but after browsing through some of the post I realized it’s
    new to me. Anyhow, I’m definitely glad I found it and I’ll be bookmarking and checking back often!

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>