From: Mike Rumph
A reverse proxy (or gateway), by contrast, appears to the client just like an ordinary web server. No special configuration on the client is necessary. - The client makes ordinary requests for content in the name-space + The client makes ordinary requests for content in the namespace of the reverse proxy. The reverse proxy then decides where to - send those requests, and returns the content as if it was itself + send those requests and returns the content as if it were itself the origin.
A typical usage of a reverse proxy is to provide Internet users access to a server that is behind a firewall. Reverse proxies can also be used to balance load among several back-end - servers, or to provide caching for a slower back-end server. + servers or to provide caching for a slower back-end server. In addition, reverse proxies can be used simply to bring several servers into the same URL space.
@@ -194,7 +194,7 @@ ProxyVia OnThe proxy manages the configuration of origin servers and their communication parameters in objects called workers. - There are two built-in workers, the default forward proxy worker and the + There are two built-in workers: the default forward proxy worker and the default reverse proxy worker. Additional workers can be configured explicitly.
@@ -215,7 +215,7 @@ ProxyPass "/example" "http://backend.example.com" connectiontimeout=5 timeout=30This will create a worker associated with the origin server URL
- http://backend.example.com
and using the given timeout
+ http://backend.example.com
that will use the given timeout
values. When used in a forward proxy, workers are usually defined
via the
Using explicitly configured workers in the forward mode is
not very common, because forward proxies usually communicate with many
different origin servers. Creating explicit workers for some of the
- origin servers can still be useful, if they are used very often.
+ origin servers can still be useful if they are used very often.
Explicitly configured workers have no concept of forward or reverse
proxying by themselves. They encapsulate a common concept of
communication with origin servers. A worker created by
The URL identifying a direct worker is the URL of its origin server including any path components given:
@@ -268,13 +268,13 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10 worker is used. The benefit is, that there is only one connection pool, so connections are more often reused. Note that all configuration attributes given explicitly for the later worker will be ignored. This will be logged - as a warning. In the above example the resulting timeout value + as a warning. In the above example, the resulting timeout value for the URL/examples
will be 60
instead
of 10
!
If you want to avoid worker sharing, sort your worker definitions
by URL length, starting with the longest worker URLs. If you want to maximize
- worker sharing use the reverse sort order. See also the related warning about
+ worker sharing, use the reverse sort order. See also the related warning about
ordering
The set of options available for a direct worker
- depends on the protocol, which is specified in the origin server URL.
+ depends on the protocol which is specified in the origin server URL.
Available protocols include ajp
, fcgi
,
ftp
, http
and scgi
.
You can control who can access your proxy via the
The next example will allow web clients from the specified IP
addresses to issue CONNECT
requests to access the
- https://www.example.com/
SSL server, if
+ https://www.example.com/
SSL server if
The
IsError
Ignore
The
From 2.4.8 onwards, named groups and backreferences are captured and
@@ -595,8 +595,8 @@ context in 2.3.3 and later.
When enabled, this option will pass the Host: line from the incoming
- request to the proxied host, instead of the hostname specified in the
-
This option should normally be turned Off
. It is mostly
useful in special configurations like proxied mass name-based virtual
@@ -675,7 +675,7 @@ ProxyRemote ftp http://ftpproxy.mydomain:8080
as yet another HTTP proxy request, to another proxy which can handle
them.
This option also supports reverse proxy configuration - a backend +
This option also supports reverse proxy configuration; a backend webserver can be embedded within a virtualhost URL space even if that server is hidden by another forward proxy.
The
This directive allows for growth potential in the number of Balancers available for a virtualhost in addition to the number pre-configured. It only takes effect if there is at - least 1 pre-configured Balancer.
+ least one pre-configured Balancer.This directive will cause the current server/vhost to "inherit"
This directive adds a member to a load balancing group. It could be used
+ This directive adds a member to a load balancing group. It can be used
within a One additional parameter is available only to The balancerurl is only needed when not in The balancerurl is only needed when not within a
+ The path component of the balancer URL in any
@@ -834,8 +835,8 @@ expressions
Keep in mind that the same parameter key can have a different meaning
- depending whether it is applied to a balancer or a worker as shown by the two
- examples above regarding timeout. This directive allows remote servers to be mapped into the
- space of the local server; the local server does not act as a
+ space of the local server. The local server does not act as a
proxy in the conventional sense, but appears to be a mirror of the
remote server. The local server is often called a reverse
proxy or gateway. The path is the name of
@@ -870,7 +871,7 @@ expressions
In 2.4.7 and later, support for using a Unix Domain Socket is available by using a target
which prepends <Proxy balancer://...>
container
- directive, and can take any of the key value pair parameters available to
+ directive and can take any of the key value pair parameters available to
<Proxy balancer://...>
+ <Proxy balancer://...>
container directive. It corresponds to the url of a balancer defined in
unix:/path/lis.sock|
. For example, to proxy
- HTTP and target the UDS at /home/www/socket you would use
+ HTTP and target the UDS at /home/www/socket, you would use
unix:/home/www.socket|http://localhost/whatever/
. Since
the socket is local, the hostname used (in this case localhost
)
is moot, but it is passed as the Host: header value of the request.http://example.com/mirror/foo/bar
to be internally converted
into a proxy request to http://backend.example.com/bar
.
The following alternative syntax is possible, however it can carry a +
The following alternative syntax is possible; however, it can carry a performance penalty when present in very large numbers. The advantage of the below syntax is that it allows for dynamic control via the Balancer Manager interface:
@@ -907,7 +908,7 @@ expressionsIf the first argument ends with a trailing /, the second argument should also end with a trailing / and vice - versa. Otherwise the resulting requests to the backend may miss some + versa. Otherwise, the resulting requests to the backend may miss some needed slashes and do not deliver the expected results.
For the same reasons exclusions must come before the +
For the same reasons, exclusions must come before the
general
key=value
parameters, described in the table
+ using key=value
parameters, described in the tables
below.
By default, mod_proxy will allow and retain the maximum number of @@ -994,8 +995,8 @@ ProxyPass "/example" "http://backend.example.com" max=20 ttl=120 retry=300
SERVER_BUSY
+ connections in the pool, the Apache httpd will return SERVER_BUSY
status to the client.
This parameter should be used when you have a firewall between your
- Apache httpd and the backend server, who tend to drop inactive connections.
+ Apache httpd and the backend server, which tend to drop inactive connections.
This flag will tell the Operating System to send KEEP_ALIVE
- messages on inactive connections and thus prevent the firewall to drop the connection.
- To enable keepalive set this property value to On
.
On
.
The frequency of initial and subsequent TCP keepalive probes depends on global OS settings, and may be as high as 2 hours. To be useful, the frequency configured in the OS must be smaller than the threshold used @@ -1080,22 +1082,22 @@ ProxyPass "/example" "http://backend.example.com" max=20 ttl=120 retry=300
CPING
+ CPING
request on the ajp13 connection (implemented on Tomcat 3.3.2+, 4.1.28+
and 5.0.13+). For HTTP, it causes 100-Continue
to the backend (only valid for
HTTP/1.1 - for non HTTP/1.1 backends, this property has no
- effect). In both cases the parameter is the delay in seconds to wait
+ effect). In both cases, the parameter is the delay in seconds to wait
for the reply.
This feature has been added to avoid problems with hung and
busy backends.
This will increase the network traffic during the normal operation
which could be an issue, but it will lower the
traffic in case some of the cluster nodes are down or busy.
- By adding a postfix of ms the delay can be also set in
+ By adding a postfix of ms, the delay can be also set in
milliseconds.
D: Worker is disabled and will not accept any requests. |
S: Worker is administratively stopped. |
I: Worker is in ignore-errors mode, and will always be considered available. |
I: Worker is in ignore-errors mode and will always be considered available. |
H: Worker is in hot-standby mode and will only be used if no other viable workers are available. |
E: Worker is in an error state. |
N: Worker is in drain mode, and will only accept existing sticky sessions + |
N: Worker is in drain mode and will only accept existing sticky sessions destined for itself and ignore all other requests. |
If the Proxy directive scheme starts with the
balancer://
(eg: balancer://cluster
,
- any path information is ignored) then a virtual worker that does not really
- communicate with the backend server will be created. Instead it is responsible
- for the management of several "real" workers. In that case the special set of
- parameters can be add to this virtual worker. See
Balancer parameters |
---|
byrequests
, to perform weighted
- request counting, bytraffic
, to perform weighted
- traffic byte count balancing, or bybusyness
, to perform
- pending request balancing. Default is byrequests
.
+ request counting; bytraffic
, to perform weighted
+ traffic byte count balancing; or bybusyness
, to perform
+ pending request balancing. The default is byrequests
.
On
the session will break if the worker is in
+ On
, the session will break if the worker is in
error state or disabled. Set this value to On
if backend
servers do not support session replication.
JSESSIONID
or PHPSESSIONID
,
and it depends on the backend application server that support sessions.
- If the backend application server uses different name for cookies
- and url encoded id (like servlet containers) use | to separate them.
- The first part is for the cookie the second for the path.On
the semi-colon character ';' will be
+ On
, the semi-colon character ';' will be
used as an additional sticky session path delimiter/separator. This
is mainly used to emulate mod_jk's behavior when dealing with paths such
as JSESSIONID=6736bcf34;foo=aabfa
Off
.A sample balancer setup
+A sample balancer setup:
Setting up a hot-standby, that will only be used if no other +
Setting up a hot-standby that will only be used if no other members are available
Normally, mod_proxy will canonicalise ProxyPassed URLs. But this may be incompatible with some backends, particularly those that make use of PATH_INFO. The optional nocanon - keyword suppresses this, and passes the URL path "raw" to the - backend. Note that may affect the security of your backend, as it - removes the normal limited protection against URL-based attacks + keyword suppresses this and passes the URL path "raw" to the + backend. Note that this keyword may affect the security of your backend, + as it removes the normal limited protection against URL-based attacks provided by the proxy.
Normally, mod_proxy will include the query string when
@@ -1305,8 +1307,8 @@ ProxyPass "/" "balancer://hotcluster/"
>Location section, the first argument is omitted and the local
directory is obtained from the
This directive is not supported in
The optional interpolate keyword, in combination with
- This directive is equivalent to This directive is equivalent to Take care when constructing the target URL of the rule, considering
the security impact from allowing the client influence over the set of
URLs to which your server will act as a proxy. Ensure that the scheme
- and hostname part of the URL is either fixed, or does not allow the
+ and hostname part of the URL is either fixed or does not allow the
client undue influence.
This directive lets Apache httpd adjust the URL in the Location
,
Content-Location
and URI
headers on HTTP
redirect responses. This is essential when Apache httpd is used as a
- reverse proxy (or gateway) to avoid by-passing the reverse proxy
+ reverse proxy (or gateway) to avoid bypassing the reverse proxy
because of HTTP redirects on the backend servers which stay behind
the reverse proxy.
path is the name of a local virtual path. url is a
- partial URL for the remote server - the same way they are used for the
-
path is the name of a local virtual path; url is a
+ partial URL for the remote server. These parameters are used the same way as
+ for the
For example, suppose the local server has address
http://example.com/
; then
will not only cause a local request for the
http://example.com/mirror/foo/bar
to be internally converted
into a proxy request to http://backend.example.com/bar
- (the functionality ProxyPass
provides here). It also takes care
- of redirects the server backend.example.com
sends: when
- http://backend.example.com/bar
is redirected by him to
- http://backend.example.com/quux
Apache httpd adjusts this to
+ (the functionality which ProxyPass
provides here).
+ It also takes care of redirects which the server backend.example.com
sends
+ when redirecting http://backend.example.com/bar
to
+ http://backend.example.com/quux
. Apache httpd adjusts this to
http://example.com/mirror/foo/quux
before forwarding the HTTP
redirect response to the client. Note that the hostname used for
constructing the URL is chosen in respect to the setting of the
This directive is not supported in The In almost every case there's no reason to change that value. In almost every case, there's no reason to change that value. If used with AJP this directive sets the maximum AJP packet size in
+ If used with AJP, this directive sets the maximum AJP packet size in
bytes. Values larger than 65536 are set to 65536. If you change it from
the default, you must also change the The 512
.packetSize
attribute of
your AJP connector on the Tomcat side! The attribute
@@ -1669,9 +1671,9 @@ through
Max-Forwards
header supplied with the request. This may
- be set to prevent infinite proxy loops, or a DoS attack.Max-Forwards
if the Client didn't set it.
Earlier Apache httpd versions would always set it. A negative
Domain name comparisons are done without regard to the case, and
Domains are always assumed to be anchored in the root of the
- DNS tree, therefore two domains .ExAmple.com
and
+ DNS tree; therefore, the two domains .ExAmple.com
and
.example.com.
(note the trailing period) are considered
equal. Since a domain comparison does not involve a DNS lookup, it is much
more efficient than subnet comparison.
Hostname comparisons are done without regard to the case,
and Hostnames are always assumed to be anchored in the root
- of the DNS tree, therefore two hosts WWW.ExAmple.com
+ of the DNS tree; therefore, the two hosts WWW.ExAmple.com
and www.example.com.
(note the trailing period) are
considered equal.
This directive is useful for reverse-proxy setups, where you want to +
This directive is useful for reverse-proxy setups where you want to
have a common look and feel on the error pages seen by the end user.
This also allows for included files (via
This directive does not affect the processing of informational (1xx), normal success (2xx), or redirect (3xx) responses.
@@ -1927,18 +1929,18 @@ header for proxied requestsThis directive, together with the interpolate argument to
varname
for the string ${varname}
- in configuration directives (if the interpolate option is set).
Keep this turned off (for server performance) unless you need it!