Handling X-FORWARDED-PROTO header in Java web application

Question

Can any one guide me in working with X-FORWARDED-PROTO header in Java web application deployed to Apache Tomcat.

The application setup is in such a way that tomcat talks with Apache webserver, which in turn talks with Cisco Load Balancer, finally the balancer publishes the pages to the client (tomcat -> apache2 -> load balancer -> client).

The SSL Certificate is installed in Load Balancer and it's handling HTTPS requests. My requirement is to make the application behave in such a way that it uses the X-FORWARDED-PROTO and change the pages as HTTP or HTTPS.

Checking on the header files of my webpages I could not find the X-FORWARDED-PROTO header. I don't have access to the Load Balancer configuration either, and the IT has suggested us to use the X-FORWARDED-PROTO to differentiate between HTTP and HTTPS request.

Is there any configuration to be done in Tomcat or Apache level so that it will return the X-FORWARDED-PROTO header? Or is it that the configuration should be handled in Load Balancer?

Solution

I am pretty sure you have it all figured out by now but I will add the answer nonetheless.

You can use the class org.apache.catalina.valves.RemoteIpValve in the engine tag in conf/server.xml of tomcat.

    <Valve className="org.apache.catalina.valves.RemoteIpValve"
           internalProxies="192.168.1.XXX"
           remoteIpHeader="x-forwarded-for"
           remoteIpProxiesHeader="x-forwarded-by"
           protocolHeader="x-forwarded-proto"
    />

Something to note that is very important is to set the internalProxies value. If this is not set and you are you using a non-standard network setup it could cause some issues where tomcat will not check for x-forwarded headers and it will default to "http". For security reasons I'd recommend to set it even if it works with the defaults.

Look here for more information.

Comments

[user2519801]

If you're using Apache to proxy requests to Tomcat, you need to add this to your SSL config in Apache: RequestHeader set X-Forwarded-Proto "https"

[Alex Dean]

Tomcat 7 fields are slightly different - tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/val‌​ves/…

[em_bo]

You said "For security reasons I'd recommend to set it even if it works with the defaults." Can you elaborate? I've been wondering if this should be set even if the proxying IP(s) are in the default allowed ranges.

[codependent]

This answer is perfect. @Allan Thanks for stressing the importance of internalProxies, that was what I was missing.

[Nux]

Note that you only actually need to set protocolHeader="X-Forwarded-Proto" (and maybe internalProxies depending on your setup). The rest comes with default values that should be fine in most cases. Specifically IP is already re-written (so remoteIpHeader and remoteIpProxiesHeader is not needed).