Add a hint about how CONNECT-method requests are filtered out by <Proxy>,

and how to enable them. I could not find this information easily.

In particular, the straightforward <Proxy https://www.example.com>... does
not allow CONNECT to the corresponding SSL server. Probably it would work
if a web client sent a "GET https://www.example.com/ HTTP/1.1" to the
proxy, but none would do that.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1648846 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_proxy.xml b/docs/manual/mod/mod_proxy.xml
index 75f2f982ae6e26013fb12d2e1a1b3528713396af..db2fe401bf35e88d5722779c84d04ae235e8674f 100644 (file)
--- a/docs/manual/mod/mod_proxy.xml
+++ b/docs/manual/mod/mod_proxy.xml
@@ -490,6 +490,18 @@ ProxyPass /examples http://backend.example.com/examples timeout=10
 </Proxy>
     </highlight>
 
+    <p>The next example will allow web clients from the specified IP
+    addresses to issue <code>CONNECT</code> requests to access the
+    <code>https://www.example.com/</code> SSL server, if
+    <module>mod_proxy_connect</module> is enabled.
+    </p>
+
+   <highlight language="config">
+&lt;Proxy www.example.com:443&gt;
+  Require ip 192.168.0.0/16
+&lt;/Proxy&gt;
+   </highlight>
+
     <note><title>Differences from the Location configuration section</title>
       <p>A backend URL matches the configuration section if it begins with the 
       the <var>wildcard-url</var> string, even if the last path segment in the

diff --git a/docs/manual/mod/mod_proxy_connect.xml b/docs/manual/mod/mod_proxy_connect.xml
index 01761f2cef316279f2fb66657770db8576b3c402..76bf8b419478e440c40d98535769418db663716d 100644 (file)
--- a/docs/manual/mod/mod_proxy_connect.xml
+++ b/docs/manual/mod/mod_proxy_connect.xml
@@ -63,6 +63,19 @@
         <dt>proxy-source-port</dt>
         <dd>The local port used for the connection to the backend server.</dd>
     </dl>
+
+   <p>CONNECT method requests are controlled by the
+   <directive module="mod_proxy">Proxy</directive> block
+   as any other HTTP request going through.
+   SSL connections through a proxy may be filtered explicitely
+   by specifying the target host and port, for instance:
+   </p>
+
+   <highlight language="config">
+&lt;Proxy www.example.com:443&gt;
+  Require ip 192.168.0.0/16
+&lt;/Proxy&gt;
+   </highlight>
 </section>
 
 <directivesynopsis>