Home / server / Questions / 1049834
Accepted
JellicleCat
Asked: 2021-01-15 07:51:20 +0800 CST

Apache ProxyPass + RewriteRule?

  • 772

I've set up an apache config to try to redirect /login and to ProxyPass all other requests:

RewriteEngine on
RewriteCond "%{REQUEST_URI}" "^/login$"
RewriteRule "^/login$" "https://sub.example.org/$1" [L,R]

SSLProxyEngine on
ProxyRequests off
ProxyPassMatch   ^/login ! # Prevent proxy on /login
ProxyPassReverse ^/login ! # Prevent proxy on /login
ProxyPassMatch   ^/      https://sub.example.org/
ProxyPassReverse ^/      https://sub.example.org/
ProxyPreserveHost off
RequestHeader set Host sub.example.org
Header set Host alt.example.org

Most results that I've checked are as I expect:

  • alt.example.org/login redirects to sub.example.org/login
  • alt.example.org/users shows the content for sub.example.org/users (without redirect)

...but https://alt.example.org/ (empty path) results in a Location header with the value https://alt.example.org^/login. Wow! What's causing that redirect with the ^ in the domain, and why does it reference alt instead of sub?

The log from the Rails application which is running above apache says that the Rails app itself is actually redirecting to https://sub.example.org/login, which makes better sense because the ProxyPass means that Rails should only see sub.example.org and not alt.example.org. So why is apache giving out https://alt.example.org^/login?

mod-proxy mod-rewrite apache-2.4 proxypass

1 Answers

  1. Best Answer

    ...but https://alt.example.org/ (empty path) results in a Location header with the value https://alt.example.org^/login. Wow! What's causing that redirect with the ^ in the domain, and why does it reference alt instead of sub?

    The ProxyPassReverse directive does not take a regex as the first argument and this would seem to be where the conflict is happening. And neither can this take ! as the second argument. The alt subdomain would appear in the Location header if the ProxyPassReverse directive did not match the response.

    You don't appear to need the first ProxyPassReverse directive that relates to /login, since this URL is not being proxied.

    Also, these ProxyPassMatch directives appear to proxy everything to the root of https://sub.example.org/ - do you not want to proxy to the corresponding URL-path at the target domain? Although, strangely, that does appear to be what's happening in your observed results? If you do want to proxy to the same URL-path then you can use the simpler ProxyPass directive instead and use simple prefix-matching as opposed to a regex.

    alt.example.org/login redirects to sub.example.org/login

    Although that is not performed by the "redirect" you posted at the top, which would redirect to the document root, since the $1 backreference is empty because there is no capturing subpattern in the RewriteRule pattern. As you state later, "the Rails app itself is actually redirecting to https://sub.example.org/login".

    So, in order to redirect to sub.example.org/login (which appears to be the intention) then you would need to change the directive to read something like the following instead:

    RewriteRule ^/(login)$ https://sub.example.org/$1" [R,L]

    The preceding RewriteCond directive is not required here, since that simply repeats the same check you are already performing in the RewriteRule pattern.

    RequestHeader set Host sub.example.org

    This line is redundant, since this is the purpose of the preceding ProxyPreserveHost off directive.

    Header set Host alt.example.org

    This line would also seem to be redundant, since Host is a request header, not a response header.

    ProxyPassMatch   ^/login ! # Prevent proxy on /login

    Also, Apache does not support line-end comments. Only because of a "quirk" in the way Apache directives are processed prevents this particular line-end comment from breaking your server!

    So, taking the above points into consideration, try the following instead:

    RewriteEngine on

# Externally Redirect "/login" to other domain
RewriteRule ^/(login)$ https://sub.example.org/$1" [R,L]

SSLProxyEngine on

ProxyRequests off
ProxyPreserveHost off

# Prevent proxy on /login
ProxyPass /login !

# Proxy all other URLs
ProxyPass / https://sub.example.org/
ProxyPassReverse / https://sub.example.org/
    • 2