Reverse proxying only a specific URL

Question

I have a web server at www.ourcompany.com running Apache2. Using the proxy modules, I am able to (for example) get 172.16.0.5, an internal IP device, to be accessed on www.ourcompany.com/device.

The trouble is that anyone can play with or explore the device using strings sent to www.ourcompany.com/device/change/settings/here.html. I'd like the reverse proxy to only work for a specific URL; www.ourcompany.com/device/you/must/use/this while anything else will be rejected if requested.

Is there a setting that can be used to do this, or is it a simple rewrite condition placed in the virtualhost for the site under sites-enabled? What is the simplest, most maintainable way to sanitize requests to the internal device through the reverse proxy?

Running Apache2 on Ubuntu.

Solution

The ProxyPass directive accepts 3 different contexts: server config, virtual host, directory.

Because is is valid in a directory context, may be used inside <Directory>, <Location>, <Files>, and <Proxy> containers in the server configuration files, subject to the restrictions outlined in Configuration Sections.

In your case, you can use a Location container to specify the allowed locations.

<Location /device>
ProxyPass ...
</Location>

Comments

[GHT]

So you're saying that I could use something like <Location /device/you/must/use/this> ProxyPass 172.16.0.5 </Location> To specify that only requests to that location would be reverse-proxied?

[Simone Carletti]

Yes, exactly. You can learn more by reading the Apache documentation.