0

I am working on a setup with following configurations

Load Balancer -> Apache Web server ( 2) -> Application deployed on tomcat ( 5 nodes by clustering)

In the deployed application, we do have some secure sections which needs to be accessed using HTTPS mode, we are trying to use SSL offloading by installing SSL certificate at the load balancer level.

here are the Apache server configurations Listen 80

<VirtualHost *:80>
   ServerAdmin webmaster@dummy-host.example.com
   DocumentRoot /var/www/html/
   ServerName prod.mysite.com
   LogLevel warn
   ErrorLog logs/prod.mysite.com-error_log
   CustomLog logs/prod.mysite.com-access_log common
   Include conf/sf.conf
</VirtualHost>

sf.conf

ProxyPass /favicon.ico !
ProxyErrorOverride On
ProxyStatus On
ProxyRequests Off
ProxyBadHeader Ignore
ProxyPass / balancer://cluster/
ProxyPassReverse / balancer://cluster/

<Proxy balancer://cluster>
   BalancerMember ajp://xxx.xx.xx.xx:48009 route=node1 keepalive=On ping=3 retry=3
   BalancerMember ajp://xxx.xx.xx.xx:48009 route=node2 keepalive=On ping=3 retry=3
   BalancerMember ajp://xxx.xx.xx.xx:48009 route=node3 keepalive=On ping=3 retry=3
   ProxySet stickysession=JSESSIONID|jsessionid lbmethod=byrequests timeout=300 nofailover=On
</Proxy>

rest of the configurations are very standard Apache configurations, SSL certificate in installed correctly on the Load Balance.

When I am opening my application in HTTP mode, everything is working fine, but when application is trying to redirect to SSL mode ( https pages), I am getting infinite redirect error.

I checked the log files, it seems underlying application is redirecting client to HTTPS mode and apache web server is again sending request as HTTP , which is causing infinite redirect.

I am not sure where I am doing wrong or what piece of the process is configured incorrectly.

Can anyone help me to understand the root cause

Umesh Awasthi
  • 81
  • 1
  • 8

1 Answers1

1

The root cause is that with the load balancer doing the SSL, ALL requests to the secure section of the site will arrive as HTTP, Even when the client uses SSL. The SSL wrapper is removed by the load balancer and the request arrives at apache as a normal HTTP request and is again redirected to SSL causing an infinite loop of redirects.

The solution is to redirect based on the x-forwarded-proto header that most load balancers add to requests to solve this exact issue.

ie. if x-forwarded-proto=http redirect to HTTPS or if x-forwarded-proto=https continue as normal

see https://stackoverflow.com/questions/26620670/apache-httpx-forwarded-proto-in-htaccess-is-causing-redirect-loop-in-dev-envir for how to do this in your sites .htaccess file but a bit of googling will turn up ways of doing this on other platforms and languages.

Community
  • 1
Nath
  • 1,322
  • 9
  • 10