On 6/14/24 12:41, M Foster wrote:
Hello,I'm struggling a bit with an issue when using Apache as a reverse proxy when needing to use differing Authentication. I've searched for a couple of days now, but nothing matching what I'm seeing has come up.The scenario is that I am using Apache as a reverse proxy, but sending a sub-path to different backend like so (extremely simplified):<Location "/foo/bar"> ProxyPass http://host2:8080/foo/bar <http://host2:8080/foo/bar> </Location> <Location "/foo"> ProxyPass http://host1.example.com/foo <http://host1.example.com/foo> </Location>
One is overriding the other, so you get an arbitrary result. You can exclude /foo/bar from your second pass by using something like LocationMatch instead:
<Location /foo/bar>
.. things here for /foo/bar
</Location>
<LocationMatch "^(/foo/(?!bar).*)$">
.. things here for /foo/baz but not /foo/bar
ProxyPass "http://host1.example.com/$1";
</LocationMatch>
Do note that if the Auth realm is the same, you can get the wrong
credentials showing up if they differ. These should be unique if the
credentials are.
This works without issue. However, as soon as I try to put authentication on the second location (or more accurately different authentication directives), any request to "/foo/bar" triggers auth:Example: <Location "/foo/bar"> ProxyPass http://host2:8080/foo/bar <http://host2:8080/foo/bar> </Location> <Location "/foo"> AuthType basic AuthName "Restricted" AuthUserFile /usr/local/apache2/.htpasswd Require valid-user ProxyPass http://host1.example.com/foo <http://host1.example.com/foo> </Location>In the logs, set to trace8, I see that now apache is matching the REQUEST_URI to the wrong proxy handler:"attempting to match URI path '/foo/bar' against prefix '/foo' for proxying"URI path /foo/bar' matches proxy handler 'proxy:http:// host1.example.com/foo/bar <http://host1.example.com/foo/bar>'" "authorization result of Require valid-user : denied (no authenticated user)"Without any auth, the logs correctly show the request to `/foo/bar` being routed to the correct proxy handler 'proxy:http://host2:8080/foo/ bar <http://host2:8080/foo/bar>'.If anyone has any ideas on why adding auth completely blows up the proxy routing, I'd appreciate it. Otherwise, I'll have to create two proxy servers, just to handle each case.
--------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|