From b9780785a57131a50621de876d71b6ac34b1b792 Mon Sep 17 00:00:00 2001 From: Yann Ylavic Date: Thu, 16 Dec 2021 15:08:41 +0000 Subject: [PATCH] Merge r1896062 from trunk: [skip ci] Improve ProxyPass mapping= docs. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1896064 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_proxy.xml | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/docs/manual/mod/mod_proxy.xml b/docs/manual/mod/mod_proxy.xml index 7217b621c0f..f974f1ea036 100644 --- a/docs/manual/mod/mod_proxy.xml +++ b/docs/manual/mod/mod_proxy.xml @@ -1253,23 +1253,28 @@ ProxyPass "/example" "http://backend.example.com" max=20 ttl=120 retry=300 contexts that use a path (like <Location>) will be matched using the same mapping.

mapping=encoded prevents the %-decoding of the uri-path so - that one can match for instance /some%2furi%2fpath%2fwith%2fslash in a - ProxyPass or in a <Location> context.

+ that one can use for instance configurations like:

+ ProxyPass "/special%3Fsegment" "https://example.com/special%3Fsegment" mapping=encoded + <Location "/special%3Fsegment"> + Require ip 172.17.2.0/24 +</Location>

mapping=servlet refers to the normalization defined by the Servlet specification, which is for instance applied by Apache Tomcat for servlet containers (notably the path parameters are ignored for the mapping). An uri-path like - /some;foo/path is then mapped as /some/path hence matches:

-

<Location /some/path> or:

-

ProxyPass "/some/path" "https://tomcat.example.com/some/path"

-

regardless of the requested path parameters.

- Note -

It is recommended to use the same mapping on the Apache httpd side than the one - used on the backend side. For instance when configuring authorizations in - <Location> blocks for paths that are mapped by mod_proxy - to some servlet containers (like applications running on Apache Tomcat), one should - use the mapping=servlet setting to prevent path parameters and alike from - interfering with the authorizations that are to be enforced in by the Apache httpd.

-
+ /some;foo/path is then mapped as /some/path hence matches any + of the below regardless of the requested path parameters:

+ ProxyPass "/some/path" "https://servlet.example.com/some/path" mapping=servlet + <Location "/some/path"> + Require valid-user +</Location> + Note +

It is recommended to use the same mapping on the Apache httpd side than the one + used on the backend side. For instance when configuring authorizations in + <Location> blocks for paths that are mapped by mod_proxy + to some servlet containers (like applications running on Apache Tomcat), one should + use the mapping=servlet setting to prevent path parameters and alike from + interfering with the authorizations that are to be enforced in by the Apache httpd.

+
-- 2.47.2