1

We are running Tomcat 7 behind a load balancer that works also as SSL terminator, and an Apache HTTP Server 2.4. The Apache connects to the Tomcat via mod_proxy_ajp.

For the application it is important that Tomcat is aware that the request is coming in via HTTPS and is thus secure. As e.g. this article recommends, it is common to configure this on the Tomcat's Connector using the attributes secure="true" and possibly scheme="https" proxyPort="443". While this works, it is inconvenient since we are using HTTP for some purposes as well, and thus we would need to set up two Tomcat connectors for this purpose. And it has a smell, since this way we basically tell Tomcat to override the wrong information it gets from the Apache HTTP Server that the request is HTTPS instead of HTTP, instead of telling the Apache that it should send the correct information on the protocol and secure status.

So my question: is it somehow possible to configure the Apache HTTP Server itself that it passes the correct information via the AJP protocol: that the request is received via HTTPS and is secure? The problem is that it doesn't know it's HTTPS, since there is a SSL terminator before it and the requests arrives via HTTP, as far as it is concerned. Can I tell the Apache somehow that it's actually HTTPS?

Dr. Hans-Peter Störr
  • 25,298
  • 30
  • 102
  • 139

2 Answers2

1

A partial solution seems to be to set the protocol on a ServerName directive in the virtual host in the Apache HTTP server:

ServerName https://whatever

This way any Location: headers in redirects seem to be rewritten to https in the Apache, but the Tomcat is still passed the wrong information via AJP.

Community
  • 1
  • 1
Dr. Hans-Peter Störr
  • 25,298
  • 30
  • 102
  • 139
0

I always thought that AJP transfers this information automagically - but I'm not using mod_proxy_ajp, rather mod_jk. It's one of the reasons why I much prefer AJP over HTTP (and proxying).

Might be worth to change the module/connection

Olaf Kock
  • 46,930
  • 8
  • 59
  • 90
  • AJP does transfer this information automagically - but only if the apache http server knows it's HTTPS. But if there is a SSL terminator before the apache it doesn't know it's HTTPS because the request arrives with HTTP, as far it is concerned. How can I tell it it's really HTTPS? That's the question. – Dr. Hans-Peter Störr Jan 07 '16 at 08:01
  • oops - sorry, that's the one fact that I missed. I'm typically using Apache as *the* TLS-terminator. With that background it's easy to miss that they're separate in your case. I'll leave my answer here even though it won't be what you're looking for. My only idea (currently) would then indeed be the duplicate set of connectors, utilizing the `secure=true` attribute that you already mention in your question. – Olaf Kock Jan 07 '16 at 08:11