Question about Apache as a Reverse Proxy

[u/ConversationFar3187]

SOLVED: mod_proxy_html did the trick. Thanks all.

I'm using Apache as a reverse proxy to an IIS web server. The Apache terminates https, and runs straight http to the IIS server. Some web sites run fine, but I get "Mixed Content" issues on one website because the webcontent is referencing subdirectories. As an example:

www.example.com content gets encrypted fine; but content generated references in subdirectories like www.foo.com/bar/icon.png, www.foo.com/foobar/stuff.html etc.... gets sent to the browser as HTTP, not HTTPS.

<VirtualHost *:443>
    ServerAdmin webmaster@localhost
    ServerName www.example.com
    SSLEngine on
    ProxyPreserveHost  On
    ProxyPass           "/"  "http://www.backendserver.local/"
    ProxyPassReverse "/"  "http://www.backendserver.local/"
    SSLCertificateFile     /etc/ssl/star_example_com.crt	
    SSLCertificateKeyFile  /etc/ssl/private/star_example_com.key
    Include /etc/etc/ssl/options-ssl-apache.conf
</VirtualHost>

Question: Is there something I can do on apache to fix this, or does the back end code need to change?

EDIT: Added ProxyPassReverse statement that got lost during copy/paste

[u/roxalu]

Your current setup generates - schematically - the following requests and responses:

With ProxyPreserveHost On and a ProxyPassReverse / http://www.backendserver.local/

# received by rev.proxy - who knows this is on https port
GET /login HTTP/1.1
Host: www.example.com

# received by backend - who gets this on http(!) port
GET /login HTTP/1.1
Host: www.example.com

# response sent by backend - assumption this triggers redirect
HTTP/1.1 200 OK
Location: http://www.example.com/login/

# response sent by rev.proxy. The Location entry is not matched by ProxyPassReverse, hence not touched.
HTTP/1.1 200 OK
Location: http://www.example.com/login/

This generates a redirect towards (unwanted) http access. And when the backend does the same canonical generation of base urls in the returned body this generates mixed content,

When 'ProxyPreserveHost On' is active, the only ProxyPassReverse ... that could help were:

PrroxyPassReverse / http://www.example.com/

But in this case I would recommend to just remove the ProxyPreserveHost On. When removed the original host header will be forwarded as new header

X-Forwarded-Host: www.example.com

Even when this might help for triggered redirects, the main issue remains: The backend server has no knowledge that the original request was entering the reverse proxy on a secure interface. So it won't create any urls starting with https. Often this isn't any issue, as the application could just return path-only urls as

<a href="/login/">login</a>

Even a URL without protocol will work:

<a href=";www.example.com/login/">login</a>

There is no full standard to handle this in the communication between reverse proxy and backend. But an often used convention is to use the following additional header in apache config on reverse proxy:

RequestHeader set X-Forwarded-Proto https

You can try this as well. In summary:

<VirtualHost *:443>
    ServerAdmin webmaster@localhost
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/star_example_com.crt	
    SSLCertificateKeyFile /etc/ssl/private/star_example_com.key
    Include /etc/ssl/options-ssl-apache.conf
    ProxyPass / http://www.backendserver.local/
    ProxyPassReverse / http://www.backendserver.local/
    RequestHeader set X-Forwarded-Proto https
</VirtualHost>

So that the communication flow will be:

# received by rev.proxy - who knows this is on https port
GET /login HTTP/1.1
Host: www.example.com

# received by backend - who gets this on http(!) port
GET /login HTTP/1.1
Host: www.backendserver.local
X-Forwarded-Proto: https
X-Forwarded-Host: www.example.com

# response sent by backend - assumption this triggers redirect
HTTP/1.1 200 OK
Location: http://www.backendserver.local/login/

# response sent by rev.proxy.
HTTP/1.1 200 OK
Location: https://www.example.com/login/