How to switch to/from HTTPS using Apache as a proxy to Tomcat

Posted on by

I’m writing this down because it too me an age to figure out a way of doing this. I have a website which Tomcat is happily serving. Areas of the site require a secure connection so I’m using Spring security to require particular URLs to be accessed over HTTPS. It means that when I access http://example.org:8080/webapp/login, it’ll bump me to https://example.org:8443/webapp/login. Note: Tomcat is setup with the SSL connector and a self signed .keystore see (http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html).

I have two vhosts setup in Apache, one for the http://example.org and one for https://example.org. They are both using mod_proxy to ProxyPass and ProxyPassReverse requests to the appropriate Tomcat URL’s. The problem comes when switching to HTTPS from HTTP and vice versa. Ideally I wanted some sort of ProxyPassReverse declaration in my config for http://example.org what would change HTTP headers (that Spring sets) for https://example.org:8443/webapp into https://example.org. Except ProxyPassReverse doesn’t work like that.

Now, I realise I could simply not use Spring to manage which parts of the site should be accessed over HTTPS and which should not…and just setup Apache to redirect as appropriate. I don’t want to do that though, because that makes the task of adding these restrictions a deploy time task, rather than a development time task. I don’t want to risk someone forgetting to add new restrictions when deploying the webapp and I’d much rather the developer added these restrictions when they were working on the task and really thinking about where and when they are needed.

So, how do I solve the problem so that the app can manage its secure-ness and I can setup Apache once and forget about it? The answer is to ProxyPassReverse onto a “special” URL, which when accessed will redirect to the HTTPS (or HTTP) site. For example, if the HTTP site needed to redirect to the HTTPS site, I’d add rules like so to perform the redirect:

    # Proxy a request (from the server) to switch to https onto a special URL "/2https/"
    ProxyPassReverse /2https/ https://example.org:8443/webapp/

    # When a client requests a URL prefixed with "/2https" map it onto the secure site
    RewriteRule ^/2https/(.*)$ https://example.org/$1 [R,L]

…and you’d add something similar to the secure site Apache config. As long as I don’t mount any pages at /2http or /2https I should be ok. Note a couple of things:

  • You’ll need “SSLProxyEngine on” and “RewriteEngine on” and obviously the appropriate Apache modules loaded for these commands.
  • Because of the redirect between HTTP <-> HTTPS you won’t be able to POST data between them directly (I’m not sure why you’d NEED to though)
  • Obviously you’ll need to setup Apache with an SSL certificate…but that is a different story

I should say a special thanks to this random site – from whence the idea actually came from. If anyone has any better ideas on how to do it I’d love to hear them. Please comment below.

12,020 thoughts on “How to switch to/from HTTPS using Apache as a proxy to Tomcat”

  4. درود فراوان، من اخیرا در حال جستجو در اینترنت به این صفحه آشنا شدم و
    واقعا خیلی خوشم اومد. نوشته‌هاش به‌دردبخور بود و خیلی کم پیش میاد همچین وبسایتی ببینم.
    احساس می‌کنم برای افراد مختلف
    مفید باشه. اگه دنبال یه سایت خوب هستن حتما برن ببینن.
    به طور کلی تجربه خوبی بود و قطعا بازدیدش می‌کنم

    جمع‌بندی

    برای افرادی که تمایل دارن

    شرط بندی

    درگیر هستن

    این پلتفرم

    به نظر میاد بتونه

    مفید واقع بشه

    از سوی دیگر

    وبسایت‌هایی مثل

    enfeϳɑronline محبوب

    و

    دامنه sibbet

    در بین کاربران شناخته شدن

    در جمع‌بندی

    قابل توجه بود

    و

    به احتمال قوی

    دوباره استفاده می‌کنم

    .

    Vіsit my web site … سایت خبری دانشگاهی; Delilah,

  13. Настройка зарплатного модуля 1С — теперь расчёт зарплаты занимает час вместо двух дней. Все начисления автоматические ошибок стало в разы меньше. Сотрудники довольны. техподдержка 1С 24/7 Белгород

  15. Маркировка товаров в 1С — настроили работу с Честным знаком. Сканируем коды они привязываются к позициям. На проверках никаких вопросов от надзорных органов не возникало. обучение 1С Белгород

  21. I’m very pleased to find this great site. I want to to thank you
    for ones time for this particularly wonderful read!!
    I definitely loved every little bit of it and i also have you book marked to look at
    new stuff on your site.

  24. کلاً

    برای اون دسته علاقه‌مندها

    بازی‌های کازینویی

    کار می‌کنن

    این صفحه

    فکر کنم بتونه

    مناسب کاربران باشه

    از سوی دیگر

    وبسایت‌هایی مثل

    enfejaronline برتر

    و

    ѕibbеt معتبر

    در حال رشد هستن

    نتیجه نهایی اینکه

    قابل توجه بود

    و

    در دفعات بعد

    بازم سر میزنم

    Heeгe iiѕ my web-site :: نکات کاربردی برای شروع بازی انفجار

  33. Your means of describing the whole thing in this article is actually
    good, every one can without difficulty be aware of it, Thanks a lot.

  46. I always spent my half an hour to read this web site’s articles or reviews
    every day along with a mug of coffee.

  50. Thanks for the shout-out about our mobile experience! We put a lot of effort into making sure the mobile version is smooth, fast, and easy to navigate — exactly so you can play whenever, wherever, without any hiccups. Stoked to hear it’s working well for you. Keep enjoying those seamless spins on the go! Upon finalizing the Kingmaker Login and registration in Australia, participants are required to submit specific documentation to uphold security measures and adhere to regulations before engaging in real-money gameplay. Initially, a form of identification, such as a passport, national ID card, or driver’s license, must be submitted. This serves to verify your identity and confirm that you meet the legal age requirements. Additionally, a document that verifies your residential address is needed, which could be a recent utility bill, a bank statement, or any official paperwork displaying your name and address. These documents are essential for confirming your residency and ensuring compliance with anti-money laundering regulations.
    https://cleanzoid.com/review-mr-run-casino-for-united-kingdom-players/
    Best Online Casino Payouts. While there are various aspects and features to consider when choosing an online casino for your gambling needs, there are a few key components that stand out from the rest. Security, bonuses, and payment speed are at the top of the list yet arguably one of the most important things to consider is the casino payouts. This dark witchcraft slot machine is available at some of the top online casinos, pokies. Sign up by clicking the link provided and get in on the fantastic deposit welcome offer, it can be difficult to know which ones offer the best welcome bonuses. Not to be outdone, Buran Casino provides a bLoyalty Club, Live Chat, and various payment methods, all of which Doggo Casino lacks. Buran Casino accepts bitcoins, although CasinoEuro does not. If you’re looking for a casino with many unique offers, Buran Casino is the place to go.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>