Apache/Tomcat don't see secure channels.

[digerata]

Here is my second, much more difficult problem. Our application is laid out like so:

INSSL -> HALB -> Apache/Tomcat

Our certificate is installed on the INSSL appliance. Everything works great when accessing the application using https://. The problem is when we turn on checks in the application that ensure it runs over HTTPS. We have some rules that ensure if a user comes in over http://, the connection is switched to https://. These are:

- Specific urls are run as only https... (/login, etc)
- If a user is on a free plan, they are forced back to http for any other urls
- If a user is on a paying plan, and they have chosen to use https, they are forced on to https.

The problem here is that both Apache and Tomcat never see the https request because INSSL decrypts and sends it out over port 80. I was surprised to even see that request URLs actually are always http:// on Tomcat regardless of whether the request was http:// or https://.

This type of problem is solved in a very Apache/Tomcat specific way in the past. Two virtual hosts are setup on Apache, one for SSL one for non SSL. Matching connectors are setup in Tomcat, one for SSL, one for nonSSL. The SSL connector is marked as secure and that allows the application to see it as secure (even though it actually was decrypted by Apache).

Of course, that won't work in this case because Apache is never seeing the SSL requests.

I've hit a wall on this one. Any ideas?

[Karl]

Hi,

You need to change your check to look for the X-Forwarded-Proto header, the value will be https if it's an HTTPS connection.

Thanks,

[digerata]

Could it really be that simple?!
...
code code code
...
Eureka!!

I owe you a beer. :) I thought we would end up implementing some crazy scheme as a workaround. What a relief this is. Nice and simple...

Thanks,

-Mike

[Karl]

np, it is actually tucked away in the docs - but I had to re-read them 2 or 3 times to find it, even though I knew it was there.

[PeterNic]

Karl, thanks for helping out!

I thought that posting a simple apache config setup that may be useful:


LoadModule rewrite_module modules/mod_rewrite.so
RewriteEngine on

# redirect to SSL (exclude localhost requests, such as wget on a cron job or from scripts)
RewriteCond %{HTTP:X-SSL-Request} !=1
RewriteCond %{REMOTE_HOST} !=127.0.0.1
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R,L]


(if using the standard WEBxxx appliances, you can put that configuration in the .htconf extension file on the content filesystem)

We are also considering adding an option in INSSL to redirect all http traffic to https -- for the really simple cases, like above.

Best regards,
-- Peter