Show last authors
1 If the application server (e.g. Apache Tomcat) on which {{formcycle/}} is installed is running behind another server, e.g. a reverse proxy, a load balancer or similar, it should be checked that the information of a request is passed on to it unchanged. In concrete terms this means that both the //Host// header and the protocol used must be passed on unchanged by the intermediate servers. In most standard configurations, however, this is not the case because the requests are received by the intermediate server and sent to the application server as a new request.
2
3 {{figure image="proxy_en.jpg"}}
4 Manipulation of the host and the protocol by a reverse proxy.
5 {{/figure}}
6
7 The problematic scenario (see figure) is the following:
8
9 1. The user calls the URL {{code language="none"}}https://www.example.com/formcycle{{/code}}.
10 1. The request is received and evaluated by the intermediate server.
11 1. The intermediate server makes a new request to the designated server. However, since an internal request is made here, the call URL is changed to {{code language="none"}}http://192.168.0.1/formcycle{{/code}}. This URL now arrives at the application server and no longer contains the required information about which URL was actually called by the user.
12
13 {{info}}
14 Since {{formcycle/}} interprets the original request URL of the user, especially when logging into a form, and this URL may not be determined correctly, it is necessary to configure intermediate servers accordingly. Make sure that both the HTTP header //Host// and the protocol used (//HTTP //or //HTTPS//) are forwarded unchanged. Also, the correct forwarding of WebSocket connections must be provided. Alternatively to the concret protocols, the intermediate server can also use //X-Forwarded// headers to indicate which protocol the request used originally.
15 {{/info}}
16
17 == Example configuration Apache ==
18
19 For the correct configuration of an Apache server, which acts as a reverse proxy, three points are relevant and have to be stored e.g. in the configuration of the VirtualHosts:
20
21 1. The instruction {{code language="none"}}ProxyPreserveHost On{{/code}} to get the originally called //Host// header
22 1. The separation of the individual protocols and its usage when forwarding to the application server. This means that for //HTTP// and //HTTPS// a separate VirtualHost with appropriate configuration must be used.
23 1. Configuration of the conditional RewriteRule for the forwarding of WebSocket connections via WS and WSS. By default, FORMCYCLE uses the corresponding ports of the servlet container (WS port = HTTP port, WSS port = HTTPS port).
24
25 For the Apache settings it is necessary to activate the corresponding modules. The following are required as minimum:
26
27 * proxy
28 * proxy_http
29 * proxy_wstunnel
30 * rewrite
31
32 Further information about the modules of Apache you will find [[here>>https://httpd.apache.org/docs/current/mod/||rel="noopener noreferrer" target="_blank"]].
33
34 The configuration described above, as well as any settings that may be necessary when using self-generated certificates, is briefly illustrated here:
35
36 (((
37 {{code language="none"}}
38 <VirtualHost www.example.com:80>
39 ...
40 # Enables retention of the originally called host up to the application server.
41 ProxyPreserveHost On
42 ...
43 # Forwarding via HTTP
44 ProxyPass / http://192.168.0.1/
45 ProxyPassReverse / http://192.168.0.1/
46 ...
47 # Forwarding of websocket-connections via WS
48 RewriteEngine on
49 RewriteCond %{HTTP:Upgrade} websocket [NC]
50 RewriteCond %{HTTP:Connection} upgrade [NC]
51 RewriteRule ^/?(.*) "ws://192.168.0.1:80/$1" [P,L]
52 </VirtualHost>
53
54 <IfModule mod_ssl.c>
55 <VirtualHost www.example.com:443>
56 ...
57 SSLEngine on
58 SSLProxyEngine On
59 ...
60 # Enables retention of the originally called host up to the application server.
61 ProxyPreserveHost On
62
63 # Deactivates the certificate check of the application server if necessary.
64 # Necessary if the certificates are self-created.
65 SSLProxyVerify none
66 SSLProxyCheckPeerCN off
67 SSLProxyCheckPeerName off
68 SSLProxyCheckPeerExpire off
69 ...
70 # Forwarding via HTTPS
71 ProxyPass / https://192.168.0.1/
72 ProxyPassReverse / https://192.168.0.1/
73 ...
74 # Forwarding of websocket-connections via WSS
75 RewriteEngine on
76 RewriteCond %{HTTP:Upgrade} websocket [NC]
77 RewriteCond %{HTTP:Connection} upgrade [NC]
78 RewriteRule ^/?(.*) "wss://192.168.0.1:443/$1" [P,L]
79 </VirtualHost>
80 </IfModule>
81 {{/code}}
82 )))
83
84 == Usage of //X-Forwarded// headers for unencrypted communication ==
85
86 If the intermediate server supports sending //X-Forwarded// headers and the servlet container which hosts {{formcycle/}} can evaluate these headers, the communication between the intermediate server and {{formcycle/}} can also be done via another protocol. Both the intermediate server and the servlet container must be configured to use these headers. For more information on configuration, refer to the documentation of the respective product.
87
88 === Configuration examples ===
89
90 With //Apache//, for example, the following configuration inside the responsible //VirtualHost//s can be used to include the appropriate headers:
91
92 {{code language="none"}}
93 //HTTP
94 RequestHeader set X-Forwarded-Port "80"
95 RequestHeader set X-Forwarded-Proto "http"
96
97 //HTTPS
98 RequestHeader set X-Forwarded-Port "443"
99 RequestHeader set X-Forwarded-Proto "https"
100 {{/code}}
101
102 With //nginx//, for example, the following configuration can be used to send the corresponding headers in the section responsible for the reverse proxy:
103
104 {{code language="none"}}
105 proxy_pass http://127.0.0.1:8080/formcycle/;
106 proxy_set_header Host $http_host;
107 proxy_set_header x-real-ip $remote_addr;
108 proxy_set_header x-forwarded-proto $scheme;
109 {{/code}}
110
111 For //Apache Tomcat// servers, the following valve entry must be added to the {{code language="none"}}server.xml{{/code}} within the //catalina// engine to evaluate the sent //X-Forwarded// headers:
112
113 {{code language="none"}}
114 <Engine......
115 <Valve className="org.apache.catalina.valves.RemoteIpValve"
116 internalProxies="<IP's of the trusted proxy server>"
117 remoteIpHeader="x-forwarded-for"
118 protocolHeader="x-forwarded-proto"
119 protocolHeaderHttpsValue="https" />
120 </Engine>
121 {{/code}}
122
123 **Note:** If the configuration of the //X-Forwarded// header does not work, it may be necessary to configure the IPs of the trustworthy proxy servers in the //internalProxies// property. One or more IP addresses (e.g.: 192\.168\.0\.10|192\.168\.0\.11) or an IP address range is expected here, which can be defined using a regular expression (e.g .: 169\.254\.\d{1,3}\.\d{1,3}).