Configuring Proxy and Reverse Proxy

1. Enabling Proxy Modules

Module	Description	Enabled by Default	Notes
mod_proxy	Core proxy module for forwarding requests to other servers	Yes	Required for all proxy functionality
mod_proxy_http	Proxy module for HTTP requests	No	Must be explicitly enabled to proxy HTTP traffic
mod_proxy_ajp	Proxy module for AJP (Apache JServ Protocol) requests	No	Used for communication with Tomcat and other AJP-compatible servers
mod_proxy_balancer	Module for load balancing across multiple backend servers	No	Requires mod_proxy and mod_proxy_http to be enabled
mod_proxy_connect	Enables CONNECT method for proxying SSL/TLS traffic	No	Used to proxy HTTPS traffic through the server
mod_proxy_html	Modifies HTML content in proxied responses	No	Allows rewriting of URLs and links in HTML content

Example: Enabling proxy modules

sudo a2enmod proxy
sudo a2enmod proxy_http
sudo a2enmod proxy_balancer
sudo systemctl restart apache2

2. Configuring HTTP Proxy

Directive	Description	Example
ProxyRequests	Enables or disables proxy requests	`ProxyRequests Off`
ProxyVia	Controls the Via header in proxy responses	`ProxyVia On`
ProxyPreserveHost	Controls whether to preserve the original Host header	`ProxyPreserveHost On`

Example: Basic HTTP Proxy Configuration

<VirtualHost *:80>
    ServerName example.com
    ProxyRequests Off
    ProxyPreserveHost On

    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    ProxyPass /api/ http://backend.example.com/api/
    ProxyPassReverse /api/ http://backend.example.com/api/
</VirtualHost>

Note: ProxyRequests Off is required to enable reverse proxy functionality.

Warning: Ensure proper access control when using ProxyPreserveHost to prevent header injection attacks.

3. Setting Reverse Proxy

Directive	Description	Example
ProxyPass	Maps incoming requests to a backend server	`ProxyPass /api/ http://backend-server/api/`
ProxyPassReverse	Modifies the Location, Content-Location, and URI headers in the HTTP response	`ProxyPassReverse /api/ http://backend-server/api/`
ProxyPreserveHost	Controls whether the original Host header is sent to the backend server	`ProxyPreserveHost On`

Example: Basic Reverse Proxy Setup

<VirtualHost *:80>
    ServerName example.com
    ProxyPreserveHost On
    ProxyPass /api/ http://backend-server/api/
    ProxyPassReverse /api/ http://backend-server/api/
</VirtualHost>

Note: Ensure that the mod_proxy and mod_proxy_http modules are loaded.

Warning: Misconfiguring proxy settings can lead to security vulnerabilities. Always validate and sanitize backend URLs.

4. Using ProxyPreserveHost Directive

Directive	Values	Description
ProxyPreserveHost	`On` \| `Off`	Controls whether the original Host header field is passed through to the proxied server.

Example: Enabling ProxyPreserveHost

<VirtualHost *:80>
    ProxyPreserveHost On
    ProxyPass /api/ http://backend-server/api/
    ProxyPassReverse /api/ http://backend-server/api/
</VirtualHost>

Note: When ProxyPreserveHost is set to On, the original Host header from the client request is sent to the backend server. This can be useful for applications that rely on the Host header for routing or authentication.

Warning: Setting ProxyPreserveHost to On can lead to security issues if not handled carefully, especially when dealing with untrusted backend servers. Ensure that the backend server is trusted and configured to handle the forwarded Host header appropriately.

5. Configuring Proxy Timeout

Directive	Values	Description
ProxyTimeout	`seconds`	Sets the timeout for proxy requests in seconds. Default is 60 seconds.
ProxyConnectTimeout	`seconds`	Sets the timeout for establishing a connection to the proxy server. Default is 30 seconds.
ProxyReceiveTimeout	`seconds`	Sets the timeout for receiving data from the proxy server. Default is 60 seconds.

Example: Setting Proxy Timeout Values

<Proxy *>
    ProxyTimeout 120
    ProxyConnectTimeout 60
    ProxyReceiveTimeout 120
</Proxy>

6. Setting Proxy Headers

Header Name	Value Type	Description	Example
ProxyPreserveHost	`on` \| `off`	Controls whether the original Host header is preserved when forwarding requests.	`ProxyPreserveHost on`
RequestHeader	`set` \| `append`	Modifies or adds headers to the request before forwarding.	`RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"`
ProxyPass	URL	Maps URLs from the local server to the proxy server.	`ProxyPass /api/ http://backend-server/api/`

Example: Setting X-Forwarded-For Header

<Proxy *>
    RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
</Proxy>

Example: Forwarding Host Header

ProxyPreserveHost on
ProxyPass /api/ http://backend.example.com/api/

Note: When ProxyPreserveHost is set to on, the original Host header from the client request is sent to the backend server. This can be useful for applications that rely on the Host header for routing or logging.

7. Using Proxy Error Override

Directive	Description	Values	Notes
ProxyErrorOverride	Controls whether Apache should override error responses from the proxy backend	`On` \| `Off`	Default is `Off`. When set to `On`, Apache will handle error responses from the backend and return a custom error page or status code instead of passing through the backend's error response.

Example: Enabling Proxy Error Override

<Location /proxy-path>
    ProxyPass http://backend-server/path
    ProxyErrorOverride On
</Location>

Note: When ProxyErrorOverride is enabled, Apache will not forward any error status codes or messages from the backend server to the client. Instead, it will use its own error handling mechanism.

8. Enabling WebSocket Proxy

Directive	Description	Values	Notes
ProxyPass	Maps URLs to proxied content	`/websocket ws://backend:8080/websocket`	Use `ws://` for WebSocket connections
ProxyPassReverse	Modifies the Location, Content-Location and URI header fields	`/websocket ws://backend:8080/websocket`	Must match the `ProxyPass` path
Upgrade	Enables WebSocket upgrade	`Upgrade`	Required for WebSocket support
Connection	Controls connection behavior	`keep-alive`	Must be set to keep-alive for WebSocket

Example: Basic WebSocket Proxy Configuration

<VirtualHost *:80>
    ProxyPass /websocket ws://backend:8080/websocket
    ProxyPassReverse /websocket ws://backend:8080/websocket
    <Location /websocket>
        ProxyPreserveHost On
        Upgrade <!-- Required -->
        Connection "keep-alive" <!-- Required -->
    </Location>
</VirtualHost>

Note: Ensure that the backend server supports WebSocket connections and is configured to handle them properly.

Warning: Without proper Upgrade and Connection headers, WebSocket connections will fail.

9. Configuring AJP Proxy

Directive	Description	Values	Notes
ProxyPass	Maps incoming requests to backend AJP server	`/ajp-app/ ajp://backend-server:8009/`	Use with `ProxyPassReverse` for proper redirects
ProxyPassReverse	Modifies AJP responses to ensure redirects work correctly	`/ajp-app/ ajp://backend-server:8009/`	Must match the `ProxyPass` path
ProxySet	Sets AJP-specific configuration options	`ajp://backend-server:8009/`	Can set `timeout`, `max`, etc.

Example: Basic AJP Proxy Configuration

<VirtualHost *:80>
    ProxyPass /ajp-app/ ajp://backend-server:8009/
    ProxyPassReverse /ajp-app/ ajp://backend-server:8009/
</VirtualHost>

Note: Ensure mod_proxy_ajp is loaded for AJP support.

Warning: AJP protocol is not secure by default; consider using mod_ssl or mod_proxy_http for secure communication.

Directive	Default Value	Description	Notes
ProxySet	`timeout=60`	Timeout for AJP requests	Can be overridden with `ProxySet`
ProxySet	`max=100`	Maximum number of AJP connections	Adjust based on backend capacity

10. Setting Proxy Connection Pooling

Directive	Values	Description
ProxyPass	`/app/ http://backend-server/app/`	Maps a URL path to a backend server
ProxyPassReverse	`/app/ http://backend-server/app/`	Adjusts the Location, Content-Location, and URI headers in HTTP responses
ProxySet	`timeout=30`	Sets proxy-specific configuration directives

Example: Configuring Proxy Connection Pooling

<Proxy *>
    ProxySet timeout=30
    ProxySet keepalive=On
    ProxySet max=100
    ProxySet timeout=60
</Proxy>

ProxyPass /app/ http://backend-server/app/
ProxyPassReverse /app/ http://backend-server/app/

Note: The ProxySet directive can be used inside a <Proxy> container to configure connection pooling and timeout behavior for all proxied requests.

11. Managing Proxy Via Header

Header	Description	Values	Notes
Proxy-Pass	Specifies the URL to which requests should be forwarded	`http://backend-server.com/path`	Used in `ProxyPass` directive
Proxy-Pass-Reverse	Modifies the `Location`, `Content-Location`, and `URI` headers in the response from the backend server	`http://frontend-server.com/path`	Used in `ProxyPassReverse` directive
X-Forwarded-For	Identifies the original client IP address when behind a proxy	`192.168.1.100`	Used to preserve client IP in logs and application logic
X-Forwarded-Proto	Indicates the original protocol (HTTP or HTTPS) used by the client	`https`	Used to determine if the request was made over HTTPS
X-Forwarded-Host	Indicates the original host requested by the client	`example.com`	Used to reconstruct URLs correctly in the application

Example: Configuring Proxy Headers

<VirtualHost *:80>
    ProxyPreserveHost On
    ProxyPass /api/ http://backend-server.com/api/
    ProxyPassReverse /api/ http://backend-server.com/api/
    RequestHeader set X-Forwarded-Proto "http"
    RequestHeader set X-Forwarded-Host "%{HTTP_HOST}e"
</VirtualHost>

Note: The ProxyPreserveHost directive ensures that the original Host header is preserved during proxying, which can be important for applications that rely on it.

12. Testing Proxy Configuration

Example: Basic Proxy Test

curl -H "Host: example.com" http://localhost/proxy-path

Directive	Description	Default
ProxyPass	Maps a URL path to a backend server	None
ProxyPassReverse	Modifies the Location, Content-Location, and URI headers in HTTP responses	None
ProxySet	Sets proxy-specific configuration variables	None

Note: Use ProxyPassReverse to ensure correct headers are returned to the client.

Testing Steps

Start Apache with proxy configuration
Send a test request to the proxy path
Check response headers for correctness
Verify backend server receives the request

Proxy vs Reverse Proxy

Forward Proxy: Client requests are forwarded to a target server
Reverse Proxy: Server acts as an intermediary for client requests to backend servers