blocks|key|1885826|text|这个问题的典型解决方案是让代理处理任何需要的重写。例如，在Apache中，您可以使用rewrite_module和/或headers_module来更正头。再举一个例子，Nginx在配置上游服务器后，会自动为您处理这种情况和其他类似的情况。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1885827|回应评论：|1885828|remote_ip_header和protocol_header+spring+boot的配置值是什么？|1885829|让我们暂时忘记Spring+Boot。嵌入式servlet容器Tomcat提供了一个称为RemoteIpValve的阀门。这个阀门是Apache+remotip_module的一个端口。这个阀门的主要目的是为了“授权和日志记录的目的”而将“发起请求的用户代理程序视为发起用户代理程序”。为了使用这个阀门，需要对其进行配置。|1885830|请查找有关此阀门here的更多信息。|1885831|Spring+Boot通过server.tomcat.remote_ip_header和server.tomcat.protocol_header属性方便地支持通过application.properties配置该阀。|1885832|entityMap|0|LINK|mutability|MUTABLE|url|http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html|1|http://httpd.apache.org/docs/current/mod/mod_headers.html|2|http://httpd.apache.org/docs/trunk/mod/mod_remoteip.html|3|https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/valves/RemoteIpValve.html^0|16|E|0|1N|E|1|0|0|0|21|E|2|0|8|4|3|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@$A|12|B|13|1|14]|$A|15|B|16|1|17]]|C|$]]|$1|D|3|E|5|6|7|18|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|19|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|1A|8|@]|9|@$A|1B|B|1C|1|1D]]|C|$]]|$1|J|3|K|5|6|7|1E|8|@]|9|@$A|1F|B|1G|1|1H]]|C|$]]|$1|L|3|M|5|6|7|1I|8|@]|9|@]|C|$]]|$1|N|3|-4|5|6|7|1J|8|@]|9|@]|C|$]]]|O|$P|$5|Q|R|S|C|$T|U]]|V|$5|Q|R|S|C|$T|W]]|X|$5|Q|R|S|C|$T|Y]]|Z|$5|Q|R|S|C|$T|10]]]]

A typical solution to this problem is to let the proxy handle any required rewrite. For example, in Apache you can use the <a href="http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html" rel="nofollow">rewrite_module</a> and/or <a href="http://httpd.apache.org/docs/current/mod/mod_headers.html" rel="nofollow">headers_module</a> to correct headers. As another example, Nginx handles this and other similar cases automatically for you after configuring upstream servers.

In response to comments:

What are the remote_ip_header and protocol_header spring boot configuration values?

Let's forget Spring Boot for a moment. Tomcat, the embedded servlet container, features a valve known as the RemoteIpValve. This valve is a port of the Apache <a href="http://httpd.apache.org/docs/trunk/mod/mod_remoteip.html" rel="nofollow">remotip_module</a>. The primary purpose of this valve is to treat the "useragent which initiated the request as the originating useragent" for "the purposes of authorization and logging". In order for this valve to be used it needs to be configured.

Please find more information about this valve <a href="https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/valves/RemoteIpValve.html" rel="nofollow">here</a>.

Spring Boot conveniently supports configuring this valve via application.properties through the server.tomcat.remote_ip_header and server.tomcat.protocol_header properties.

blocks|key|1886151|text|在某种程度上，您的代理看起来很好，后端应用也是如此，但它似乎没有看到RemoteIpValve修改的请求。RemoteIpValve的默认行为包括代理IP地址的模式匹配(作为安全检查)，并且它只修改它认为来自有效代理的请求。Spring+Boot中的模式缺省为一组众所周知的内部IP地址，如10.*.*.*和192.168.*.*，因此如果您的代理不在其中一个上，您需要显式地配置它，例如|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1886152|server.tomcat.internal-proxies=172\\.17\\.\\d{1,3}\\.\\d{1,3}%7C127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|code-block|syntax|javascript|1886153|(使用属性文件格式，这意味着您必须对反斜杠进行双重转义)。|1886154|如果您设置了以下内容，则可以查看RemoteIpValve中正在发生的情况|1886155|logging.level.org.apache.catalina.valves.RemoteIpValve=DEBUG|1886156|或者在其中设置断点。|1886157|entityMap^0|Y|D|1H|D|41|8|4A|B|0|0|0|G|D|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]|$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|13|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|14|8|@]|D|@]|E|$]]|$1|M|3|N|5|6|7|15|8|@$9|16|A|17|B|C]]|D|@]|E|$]]|$1|O|3|P|5|H|7|18|8|@]|D|@]|E|$I|J]]|$1|Q|3|R|5|6|7|19|8|@]|D|@]|E|$]]|$1|S|3|-4|5|6|7|1A|8|@]|D|@]|E|$]]]|T|$]]

Your proxy looks fine, and so does the backend app, up to a point, but it doesn't seem to be seeing the <code>RemoteIpValve</code> modified request. The default behaviour of the <code>RemoteIpValve</code> includes a pattern match for the proxy IP address (as a security check) and it only modifies requests that it thinks are from a valid proxy. The pattern defaults in Spring Boot to a well-known set of internal IP addresses like <code>10.*.*.*</code> and <code>192.168.*.*</code>, so if your proxy isn't on one of those you need to explicitly configure it, e.g.

<pre><code>server.tomcat.internal-proxies=172\\.17\\.\\d{1,3}\\.\\d{1,3}|127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}
</code></pre>

(using properties file format, which means you have to double escape the backslashes).

You can see the what is happening in the <code>RemoteIpValve</code> if you set 

<pre><code>logging.level.org.apache.catalina.valves.RemoteIpValve=DEBUG
</code></pre>

or set a breakpoint in it.

blocks|key|1672374|text|我使用haproxy作为负载均衡器的情况与下面的配置完全相同，这对我很有效。唯一的问题是客户端IP在request.getRemoteAddr()中，而不在"X-Forwarded-For"报头中|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1672375|frontend+www
++bind+*:80
++bind+*:443+ssl+crt+crt_path
++redirect+scheme+https+if+!{+ssl_fc+}
++mode+http
++default_backend+servers

backend+servers
++mode+http
++balance+roundrobin
++option+forwardfor
++server+S1+host1:port1+check
++server+S2+host2:port2+check
++http-request+set-header+X-Forwarded-Port+%25[dst_port]
++http-request+add-header+X-Forwarded-Proto+https+if+{+ssl_fc+}|code-block|syntax|javascript|1672376|在application.properties中：|1672377|+server.use-forward-headers=true|1672378|entityMap^0|1E|N|26|H|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]|$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|O|3|-4|5|6|7|Y|8|@]|D|@]|E|$]]]|P|$]]

I had exactly the same case using haproxy as load balancer with the below configuration, which worled for me. The only thing is the client IP is in <code>request.getRemoteAddr()</code> and not in <code>"X-Forwarded-For"</code> header

<pre><code>frontend www
 bind *:80
 bind *:443 ssl crt crt_path
 redirect scheme https if !{ ssl_fc }
 mode http
 default_backend servers

backend servers
 mode http
 balance roundrobin
 option forwardfor
 server S1 host1:port1 check
 server S2 host2:port2 check
 http-request set-header X-Forwarded-Port %[dst_port]
 http-request add-header X-Forwarded-Proto https if { ssl_fc }
</code></pre>

In application.properties:

<pre><code> server.use-forward-headers=true
</code></pre>

blocks|key|1886278|text|你有没有试过设置|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1886279|++server.context-path=/appname|code-block|syntax|javascript|1886280|在Spring+Boot里？|1886281|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Have you tried setting

<pre><code> server.context-path=/appname
</code></pre>

In Spring Boot?

blocks|key|1672477|text|尝试设置重写规则，如：https://proxyserver:4433/appname+>>forward>>+http://appserver:8080/appname|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1672478|然后将应用程序上下文设置为"appname“server.context-path=/appname|1672479|因此，在本地，您可以通过http://appserver:8080/appname运行，也可以通过反向代理通过https://proxyserver:4433/appname访问|1672480|由于我使用的是JBOSS，所以jboss的standalone.xm发生了变化：|1672481|<http-listener+name="default"+socket-binding="http"+redirect-socket="https"+proxy-address-forwarding="true"+enable-http2="true"/>|code-block|syntax|javascript|1672482|Tomcat将具有类似的配置，以通知Tomcat+(+proxy+-+address+-+forwarding+="true")遵守代理转发地址。|1672483|entityMap|0|LINK|mutability|MUTABLE|url|https://proxyserver:4433/appname|1|http://appserver:8080/appname|2|3^0|B|W|0|1K|T|1|0|0|C|T|2|1J|W|3|0|0|0|0^^$0|@$1|2|3|4|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]|$A|16|B|17|1|18]]|C|$]]|$1|D|3|E|5|6|7|19|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|1A|8|@]|9|@$A|1B|B|1C|1|1D]|$A|1E|B|1F|1|1G]]|C|$]]|$1|H|3|I|5|6|7|1H|8|@]|9|@]|C|$]]|$1|J|3|K|5|L|7|1I|8|@]|9|@]|C|$M|N]]|$1|O|3|P|5|6|7|1J|8|@]|9|@]|C|$]]|$1|Q|3|-4|5|6|7|1K|8|@]|9|@]|C|$]]]|R|$S|$5|T|U|V|C|$W|X]]|Y|$5|T|U|V|C|$W|Z]]|10|$5|T|U|V|C|$W|Z]]|11|$5|T|U|V|C|$W|X]]]]

Try setting the Rewrite rule like:
<a href="https://proxyserver:4433/appname" rel="nofollow noreferrer">https://proxyserver:4433/appname</a> >>forward>> <a href="http://appserver:8080/appname" rel="nofollow noreferrer">http://appserver:8080/appname</a>

And then set your application context to "appname"
 server.context-path=/appname

So locally you can run by <a href="http://appserver:8080/appname" rel="nofollow noreferrer">http://appserver:8080/appname</a> and via Reverse Proxy you access via <a href="https://proxyserver:4433/appname" rel="nofollow noreferrer">https://proxyserver:4433/appname</a>

Since I am using JBOSS, changes in standalone.xm of jboss:

<pre><code>&lt;http-listener name="default" socket-binding="http" redirect-socket="https" proxy-address-forwarding="true" enable-http2="true"/&gt;
</code></pre>

Tomcat would have similar config, to inform Tomcat (proxy-address-forwarding="true") to respect the proxy forwarding address.

blocks|key|1886369|text|您可以配置几个与此相关的属性。application.yaml示例：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1886370|server:
++forward-headers-strategy:+native
++tomcat:
++++use-relative-redirects:+true
++++protocol-header:+x-forwarded-proto
++++remote-ip-header:+x-forwarded-for|code-block|syntax|javascript|1886371|设置server.forward-headers-strategy:+native将替换已弃用的server.use-forward-headers:true|1886372|entityMap^0|F|G|0|0|2|13|1C|V|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|R|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|S|8|@$9|T|A|U|B|C]|$9|V|A|W|B|C]]|D|@]|E|$]]|$1|M|3|-4|5|6|7|X|8|@]|D|@]|E|$]]]|N|$]]

There are several properties that you can configure, related to this.
<code>application.yaml</code> example:

<pre class="lang-yaml prettyprint-override"><code>server:
 forward-headers-strategy: native
 tomcat:
 use-relative-redirects: true
 protocol-header: x-forwarded-proto
 remote-ip-header: x-forwarded-for
</code></pre>

Setting <code>server.forward-headers-strategy: native</code> is the replacement of the deprecated <code>server.use-forward-headers:true</code>

blocks|key|1886398|text|server.use-forward-headers=true不适合我，我遇到了一个奇怪的问题，X-Forwarded-For头没有一致地填充到HttpServletRequest中。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1886399|最终使用了ForwardedHeaderFilter：https://stackoverflow.com/a/51500554/986942。|1886400|最重要的是，确保负载均衡器(代理)正确提供以下标头：|1886401|proxy_set_header+Host+$host;
proxy_set_header+X-Forwarded-Proto+https;|code-block|syntax|javascript|1886402|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/51500554/986942^0|0|V|1C|F|20|I|0|5|L|R|17|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|13|8|@$9|14|A|15|B|C]]|D|@$9|16|A|17|1|18]]|E|$]]|$1|H|3|I|5|6|7|19|8|@]|D|@]|E|$]]|$1|J|3|K|5|L|7|1A|8|@]|D|@]|E|$M|N]]|$1|O|3|-4|5|6|7|1B|8|@]|D|@]|E|$]]]|P|$Q|$5|R|S|T|E|$U|V]]]]

<code>server.use-forward-headers=true</code> did not work for me, experienced a weird issue where <code>X-Forwarded-For</code> header is not populated to <code>HttpServletRequest</code> consistently.
Ended up using <code>ForwardedHeaderFilter</code>: <a href="https://stackoverflow.com/a/51500554/986942">https://stackoverflow.com/a/51500554/986942</a>.
On top of that, make sure the load balancer (proxy) provide the following headers properly:
<pre><code>proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
</code></pre>

We have a Spring Boot (Spring MVC) app with embedded Tomcat on a dedicated appserver behind an Apache SSL proxy.
The SSL port on the proxy server is 4433, forwarding to port 8080 on the appserver.
So the URL to the proxy server is forwarding like:
<pre><code>https://proxyserver:4433/appname &gt;&gt;forward&gt;&gt; http://appserver:8080/
</code></pre>
When running WITHOUT proxy, the first thing that happens is that 
Spring Security redirects the request, like:
<pre><code>http://appserver:8080/ &gt;&gt;redirect&gt;&gt; http://appserver:8080/login
</code></pre>
to display the login form, by extending <code>WebSecurityConfigurerAdapter</code> with
<pre><code> ...
 httpSecurity.formLogin().loginPage(&quot;/login&quot;) ...
 ...
</code></pre>
It works fine without the proxy, but WITH proxy the redirect needs to be changed, 
so Spring should instead redirect to the corresponding proxy URL, like:
<pre><code>http://appserver:8080/ &gt;&gt;redirect&gt;&gt; https://proxyserver:4433/appname/login
</code></pre>
but no success yet.
I am trying to apply this solution:
<a href="https://docs.spring.io/spring-boot/docs/1.1.1.RELEASE/reference/html/howto-embedded-servlet-containers.html#howto-use-tomcat-behind-a-proxy-server" rel="noreferrer">59.8 Use Tomcat behind a front-end proxy server</a>
We have configured <a href="https://en.wikipedia.org/wiki/Mod_proxy" rel="noreferrer">mod_proxy</a> in Apache, and verified that it sends the expected headers:
<pre><code>X-Forwarded-For: xxx.xxx.xxx.xxx
X-Forwarded-Host: proxyserver
X-Forwarded-Port: 4433
X-Forwarded-Proto: https
</code></pre>
The application is started with parameters:
<pre><code>export ARG1='-Dserver.tomcat.protocol-header=x-forwarded-proto' 
export ARG2='-Dserver.tomcat.remote-ip-header=x-forwarded-for'
java $ARG1 $ARG2 -jar webapp.jar
</code></pre>
Still the redirect does not work.
It will keep redirecting locally, to <code>http://appserver:8080/login</code> which is not available to the clients.
Is there anything else we need to do to make this scenario work?
 
<h2>UPDATE</h2>
Also, I am concerned about the &quot;/appname&quot; part in the proxy URL. On the appserver the application is rooted at &quot;/&quot;. How should Spring be instructed that &quot;/appname&quot; should be included in all URLs sent back to the clients, when going thru the proxy?

Spring Boot with embedded Tomcat behind Apache proxy

负载均衡

Spring Boot

服务器

容器

我们有一个Spring Boot (Spring MVC)应用程序，在Apache SSL代理后面的专用应用程序服务器上嵌入了Tomcat。代理服务器上的SSL端口是4433，转发到应用程序服务器上的端口8080。因此，指向代理服务器的URL转发方式如下：https://proxyserver:4433/appname...

问在Apache代理后面嵌入Tomcat的Spring Boot
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Apache代理后面嵌入Tomcat的Spring BootEN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Apache代理后面嵌入Tomcat的Spring Boot
EN