GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing httpd.apache.org — mod_proxy - Apache HTTP Server Version 2.4  Apache Module mod_proxy
SummaryWarningDo not enable proxying with
A set of modules must be loaded into the server to provide the
necessary features. These modules can be included statically at
build time or dynamically via the
In addition, extended features are provided by other modules.
Caching is provided by Topics
Directives
Bugfix checklistSee also Forward Proxies and Reverse Proxies/Gateways ¶Apache HTTP Server can be configured in both a forward and reverse proxy (also known as gateway) mode. An ordinary forward proxy is an intermediate server that sits between the client and the origin server. In order to get content from the origin server, the client sends a request to the proxy naming the origin server as the target. The proxy then requests the content from the origin server and returns it to the client. The client must be specially configured to use the forward proxy to access other sites. A typical usage of a forward proxy is to provide Internet
access to internal clients that are otherwise restricted by a
firewall. The forward proxy can also use caching (as provided
by The forward proxy is activated using the A reverse proxy (or gateway), by contrast, appears to the client just like an ordinary web server. No special configuration on the client is necessary. The client makes ordinary requests for content in the namespace of the reverse proxy. The reverse proxy then decides where to send those requests and returns the content as if it were itself the origin. A typical usage of a reverse proxy is to provide Internet users access to a server that is behind a firewall. Reverse proxies can also be used to balance load among several back-end servers or to provide caching for a slower back-end server. In addition, reverse proxies can be used simply to bring several servers into the same URL space. A reverse proxy is activated using the Basic Examples ¶The examples below are only a very basic idea to help you get started. Please read the documentation on the individual directives. In addition, if you wish to have caching enabled, consult
the documentation from Reverse ProxyProxyPass "/foo" "http://foo.example.com/bar" ProxyPassReverse "/foo" "http://foo.example.com/bar" Forward ProxyProxyRequests On ProxyVia On <Proxy "*"> Require host internal.example.com </Proxy> Websocket Upgrade (2.4.47 and later)ProxyPass "/some/ws/capable/path/" "http://example.com/some/ws/capable/path/" upgrade=websocket Access via Handler ¶You can also force a request to be handled as a reverse-proxy request, by creating a suitable Handler pass-through. The example configuration below will pass all requests for PHP scripts to the specified FastCGI server using reverse proxy: Reverse Proxy PHP scripts<FilesMatch "\.php$">
# Unix sockets require 2.4.7 or later
SetHandler "proxy:unix:/path/to/app.sock|fcgi://localhost"
</FilesMatch>
This feature is available in Apache HTTP Server 2.4.10 and later. Workers ¶The proxy manages the configuration of origin servers and their communication parameters in objects called workers. There are two built-in workers: the default forward proxy worker and the default reverse proxy worker. Additional workers can be configured explicitly. The two default workers have a fixed configuration and will be used if no other worker matches the request. They do not use HTTP Keep-Alive or connection reuse. The TCP connections to the origin server will instead be opened and closed for each request. Explicitly configured workers are identified by their URL.
They are usually created and configured using
ProxyPass "/example" "http://backend.example.com" connectiontimeout=5 timeout=30 This will create a worker associated with the origin server URL
ProxySet "http://backend.example.com" connectiontimeout=5 timeout=30 or alternatively using <Proxy "http://backend.example.com"> ProxySet connectiontimeout=5 timeout=30 </Proxy> Using explicitly configured workers in the forward mode is
not very common, because forward proxies usually communicate with many
different origin servers. Creating explicit workers for some of the
origin servers can still be useful if they are used very often.
Explicitly configured workers have no concept of forward or reverse
proxying by themselves. They encapsulate a common concept of
communication with origin servers. A worker created by
The URL identifying a direct worker is the URL of its origin server including any path components given: ProxyPass "/examples" "http://backend.example.com/examples" ProxyPass "/docs" "http://backend.example.com/docs" This example defines two different workers, each using a separate connection pool and configuration. Worker SharingWorker sharing happens if the worker URLs overlap, which occurs when the URL of some worker is a leading substring of the URL of another worker defined later in the configuration file. In the following example ProxyPass "/apps" "http://backend.example.com/" timeout=60 ProxyPass "/examples" "http://backend.example.com/examples" timeout=10 the second worker isn't actually created. Instead the first
worker is used. The benefit is, that there is only one connection pool,
so connections are more often reused. Note that all configuration attributes
given explicitly for the later worker will be ignored. This will be logged
as a warning. In the above example, the resulting timeout value
for the URL If you want to avoid worker sharing, sort your worker definitions
by URL length, starting with the longest worker URLs. If you want to maximize
worker sharing, use the reverse sort order. See also the related warning about
ordering Explicitly configured workers come in two flavors:
direct workers and (load) balancer workers.
They support many important configuration attributes which are
described below in the The set of options available for a direct worker
depends on the protocol which is specified in the origin server URL.
Available protocols include Balancer workers are virtual workers that use direct workers known as their members to actually handle the requests. Each balancer can have multiple members. When it handles a request, it chooses a member based on the configured load balancing algorithm. A balancer worker is created if its worker URL uses
DNS resolution for origin domainsDNS resolution happens when the socket to
the origin domain is created for the first time.
When connection reuse is enabled, each backend domain is resolved
only once per child process, and cached for all further connections
until the child is recycled. This information should to be considered
while planning DNS maintenance tasks involving backend domains.
Please also check Controlling Access to Your Proxy ¶You can control who can access your proxy via the <Proxy "*"> Require ip 192.168.0 </Proxy> HTTPS/CONNECT requestsThe For more information on access control directives, see
Strictly limiting access is essential if you are using a
forward proxy (using the See Also the Proxy-Chain-Auth environment variable. Slow Startup ¶If you're using the Intranet Proxy ¶An Apache httpd proxy server situated in an intranet needs to forward
external requests through the company's firewall (for this, configure
the Users within an intranet tend to omit the local domain name from their
WWW requests, thus requesting "http://somehost/" instead of
Protocol Adjustments ¶For circumstances where These are the <Location "/buggyappserver/"> ProxyPass "http://buggyappserver:7001/foo/" SetEnv force-proxy-request-1.0 1 SetEnv proxy-nokeepalive 1 </Location> Note that In 2.4.26 and later, the "no-proxy" environment variable can be set to disable
Request Bodies ¶Some request methods such as POST include a request body.
The HTTP protocol requires that requests which include a body
either use chunked transfer encoding or send a
Under some circumstances, the server must spool request bodies to disk to satisfy the requested handling of request bodies. For example, this spooling will occur if the original body was sent with chunked encoding (and is large), but the administrator has asked for backend requests to be sent with Content-Length or as HTTP/1.0. This spooling can also occur if the request body already has a Content-Length header, but the server is configured to filter incoming request bodies. Reverse Proxy Request Headers ¶When acting in a reverse-proxy mode (using the
Be careful when using these headers on the origin server, since
they will contain more than one (comma-separated) value if the
original request already contained one of these headers. For
example, you can use See also the Note: If you need to specify custom request headers to be
added to the forwarded request, use the
BalancerGrowth Directive ¶
This directive allows for growth potential in the number of Balancers available for a virtualhost in addition to the number pre-configured. It only takes effect if there is at least one pre-configured Balancer. The value must be between 0 and 1000. BalancerInherit Directive ¶
This directive will cause the current server/vhost to "inherit" ProxyPass Balancers and Workers defined in the main server. This can cause issues and inconsistent behavior if using the Balancer Manager and so should be disabled if using that feature. The setting in the global server defines the default for all vhosts. BalancerMember Directive ¶
This directive adds a member to a load balancing group. It can be used
within a One additional parameter is available only to The balancerurl is only needed when not within a
The path component of the balancer URL in any
Trailing slashes should typically be removed from the URL of a
BalancerPersist Directive ¶
This directive will cause the shared memory storage associated with the balancers and balancer members to be persisted across restarts. This allows these local changes to not be lost during the normal restart/graceful state transitions. NoProxy Directive ¶
This directive is only useful for Apache httpd proxy servers within
intranets. The ExampleProxyRemote "*" "http://firewall.example.com:81" NoProxy ".example.com" "192.168.112.0/21" The host arguments to the
See also<Proxy> Directive ¶
Directives placed in For example, the following will allow only hosts in
<Proxy "*"> Require host yournetwork.example.com </Proxy> The following example will process all files in the <Proxy "http://example.com/foo/*"> SetOutputFilter INCLUDES </Proxy> WarningThis configuration section does not canonicalize any part of the string being matched such as schemes, hostnames, IP addresses, etc. Care should be taken if using it for access control, including but not limited to denying access by default and allowing expected hostnames rather than the inverse where a denial could be bypassed by using alternate forms.Differences from the Location configuration sectionA backend URL matches the configuration section if it begins with the
the wildcard-url string, even if the last path segment in the
directive only matches a prefix of the backend URL. For example,
<Proxy "http://example.com/foo"> matches all of
http://example.com/foo, http://example.com/foo/bar, and
http://example.com/foobar. The matching of the final URL differs
from the behavior of the For more control over the matching, see See alsoProxy100Continue Directive ¶
This directive determines whether the proxy should forward 100-continue
Expect:ation to the origin server and thus let it decide when/if
the HTTP request body should be read, or when EffectivenessThis option is of use only for HTTP proxying, as handled by ProxyAddHeaders Directive ¶
This directive determines whether or not proxy related information should be passed to the backend server through X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server HTTP headers. EffectivenessThis option is of use only for HTTP proxying, as handled by ProxyBadHeader Directive ¶
The
ProxyBlock Directive ¶
The ExampleProxyBlock "news.example.com" "auctions.example.com" "friends.example.com" Note that Hosts would also be matched if referenced by IP address. Note also that ProxyBlock "*" blocks connections to all sites. ProxyDomain Directive ¶
This directive is only useful for Apache httpd proxy servers within
intranets. The ExampleProxyRemote "*" "http://firewall.example.com:81" NoProxy ".example.com" "192.168.112.0/21" ProxyDomain ".example.com" ProxyErrorOverride Directive ¶
This directive is useful for reverse-proxy setups where you want to
have a common look and feel on the error pages seen by the end user.
This also allows for included files (via
This directive does not affect the processing of informational (1xx), normal success (2xx), or redirect (3xx) responses. By default Example for default behaviorProxyErrorOverride On To change the default behavior, you can specify the status codes to consider, separated by spaces. If you do so, all other status codes will be ignored. You can only specify status codes, that are considered error codes: between 400 (including) and 600 (excluding). Example for custom status codesProxyErrorOverride On 403 405 500 501 502 503 504 ProxyIOBufferSize Directive ¶
The In almost every case, there's no reason to change that value. If used with AJP, this directive sets the maximum AJP packet size in
bytes. Values larger than 65536 are set to 65536. If you change it from
the default, you must also change the Normally it is not necessary to change the maximum packet size. Problems with the default value have been reported when sending certificates or certificate chains. <ProxyMatch> Directive ¶
The WarningThis configuration section does not canonicalize any part of the string being matched such as schemes, hostnames, IP addresses, etc. Care should be taken if using it for access control, including but not limited to denying access by default and allowing expected hostnames rather than the inverse where a denial could be bypassed by using alternate forms.From 2.4.8 onwards, named groups and backreferences are captured and
written to the environment with the corresponding name prefixed with
"MATCH_" and in upper case. This allows elements of URLs to be referenced
from within expressions and modules like
<ProxyMatch "^http://(?<sitename>[^/]+)">
Require ldap-group cn=%{env:MATCH_SITENAME},ou=combined,o=Example
</ProxyMatch>
See alsoProxyMaxForwards Directive ¶
The ExampleProxyMaxForwards 15 Note that setting ProxyPass Directive ¶
This directive allows remote servers to be mapped into the space of the local server. The local server does not act as a proxy in the conventional sense but appears to be a mirror of the remote server. The local server is often called a reverse proxy or gateway. The path is the name of a local virtual path; url is a partial URL for the remote server and cannot include a query string. It is strongly suggested to review the concept of a
Worker before proceeding any further
with this section.
The
ProxyRequests directive should
usually be set off when using
ProxyPass.In 2.4.7 and later, support for using a Unix Domain Socket is available by using a target
which prepends The path associated with the
unix:
URL is DefaultRuntimeDir aware.When used inside a Suppose the local server has address <Location "/mirror/foo/">
ProxyPass "http://backend.example.com/"
</Location>
will cause a local request for
If you require a more flexible reverse-proxy configuration, see the
The following alternative syntax is possible; however, it can carry a performance penalty when present in very large numbers. The advantage of the below syntax is that it allows for dynamic control via the Balancer Manager interface: ProxyPass "/mirror/foo/" "http://backend.example.com/" If the first argument ends with a trailing /, the second argument should also end with a trailing /, and vice versa. Otherwise, the resulting requests to the backend may miss some needed slashes and do not deliver the expected results. The <Location "/mirror/foo/">
ProxyPass "http://backend.example.com/"
</Location>
<Location "/mirror/foo/i">
ProxyPass "!"
</Location>
ProxyPass "/mirror/foo/i" "!" ProxyPass "/mirror/foo" "http://backend.example.com" will proxy all requests to Mixing ProxyPass settings in different contexts does not work: ProxyPass "/mirror/foo/i" "!"
<Location "/mirror/foo/">
ProxyPass "http://backend.example.com/"
</Location>
In this case, a request to Ordering ProxyPass DirectivesThe configured Ordering ProxyPass Directives in LocationsOnly one Exclusions and the no-proxy environment variableExclusions must come before the
general ProxyPass In Apache HTTP Server 2.1 and later, mod_proxy supports pooled
connections to a backend server. Connections created on demand
can be retained in a pool for future use. Limits on the pool size
and other settings can be coded on
the Maximum connections to the backendBy default, mod_proxy will allow and retain the maximum number of
connections that could be used simultaneously by that web server child
process. Use the Connection pooling with prefork MPMWith the prefork MPM, connections to backends are not pooled
(each child process handles one connection at a time). The
Use the ExampleProxyPass "/example" "http://backend.example.com" max=20 ttl=120 retry=300
If the Proxy directive scheme starts with the
A sample balancer setup: ProxyPass "/special-area" "http://special.example.com" smax=5 max=10
ProxyPass "/" "balancer://mycluster/" stickysession=JSESSIONID|jsessionid nofailover=On
<Proxy "balancer://mycluster">
BalancerMember "ajp://1.2.3.4:8009"
BalancerMember "ajp://1.2.3.5:8009" loadfactor=20
# Less powerful server, don't send as many requests there,
BalancerMember "ajp://1.2.3.6:8009" loadfactor=5
</Proxy>
Configuring hot spares can help ensure that a certain number of workers are always available for use per load balancer set: ProxyPass "/" "balancer://sparecluster/"
<Proxy balancer://sparecluster>
BalancerMember ajp://1.2.3.4:8009
BalancerMember ajp://1.2.3.5:8009
# The servers below are hot spares. For each server above that is unusable
# (draining, stopped, unreachable, in error state, etc.), one of these spares
# will be used in its place. Two servers will always be available for a request
# unless one or more of the spares is also unusable.
BalancerMember ajp://1.2.3.6:8009 status=+R
BalancerMember ajp://1.2.3.7:8009 status=+R
</Proxy>
Setting up a hot-standby that will only be used if no other members (or spares) are available in the load balancer set: ProxyPass "/" "balancer://hotcluster/"
<Proxy "balancer://hotcluster">
BalancerMember "ajp://1.2.3.4:8009" loadfactor=1
BalancerMember "ajp://1.2.3.5:8009" loadfactor=2.25
# The server below is on hot standby
BalancerMember "ajp://1.2.3.6:8009" status=+H
ProxySet lbmethod=bytraffic
</Proxy>
Additional ProxyPass Keywords Normally, mod_proxy will canonicalise ProxyPassed URLs. But this may be incompatible with some backends, particularly those that make use of PATH_INFO. The optional nocanon keyword suppresses this and passes the URL path "raw" to the backend. Note that this keyword may affect the security of your backend, as it removes the normal limited protection against URL-based attacks provided by the proxy. Normally, mod_proxy will include the query string when generating the SCRIPT_FILENAME environment variable. The optional noquery keyword (available in httpd 2.4.1 and later) prevents this. The optional RewriteEngine On
RewriteCond "%{HTTPS}" =off
RewriteRule "." "-" [E=protocol:http]
RewriteCond "%{HTTPS}" =on
RewriteRule "." "-" [E=protocol:https]
RewriteRule "^/mirror/foo/(.*)" "%{ENV:protocol}://backend.example.com/$1" [P]
ProxyPassReverse "/mirror/foo/" "http://backend.example.com/"
ProxyPassReverse "/mirror/foo/" "https://backend.example.com/"
Protocol UpgradeSince Apache HTTP Server 2.4.47, protocol Upgrade (tunneling) can be handled
end-to-end by End-to-end means that the HTTP Upgrade request from the client/browser is first
forwarded by See Websocket Upgrade (2.4.47 and later) for an example of
configuration using For Apache HTTP Server 2.4.46 and earlier (or if
ProxyPassInherit Directive ¶
This directive will cause the current server/vhost to "inherit"
The setting in the global server defines the default for all vhosts. Disabling ProxyPassInherit also disables ProxyPassInterpolateEnv Directive ¶
This directive, together with the The scheme/hostname/port portion of Performance warningKeep this turned off unless you need it!
Adding variables to ProxyPassMatch Directive ¶
This directive is equivalent to This directive cannot be used within a
<Directory> context.Worker matching with backreferencesWhen ProxyPass "/notused" "http://backend.example.com/" connectiontimeout=5 timeout=30 ProxyPassMatch "^/(.*\.gif)$" "http://backend.example.com/$1" The explicit Suppose the local server has address ProxyPassMatch "^/(.*\.gif)$" "http://backend.example.com/$1" will cause a local request for
The When used inside a If you require a more flexible reverse-proxy configuration, see the
Default SubstitutionWhen the URL parameter doesn't use any backreferences into the regular expression, the original URL will be appended to the URL parameter.
|
| Description: | Adjusts the URL in HTTP response headers sent from a reverse proxied server |
|---|---|
| Syntax: | ProxyPassReverse [path] url
[interpolate] |
| Context: | server config, virtual host, directory |
| Status: | Extension |
| Module: | mod_proxy |
This directive lets Apache httpd adjust the URL in the Location,
Content-Location and URI headers on HTTP
redirect responses. This is essential when Apache httpd is used as a
reverse proxy (or gateway) to avoid bypassing the reverse proxy
because of HTTP redirects on the backend servers which stay behind
the reverse proxy.
Only the HTTP response headers specifically mentioned above
will be rewritten. Apache httpd will not rewrite other response
headers, nor will it by default rewrite URL references inside HTML pages.
This means that if the proxied content contains absolute URL
references, they will bypass the proxy. To rewrite HTML content to
match the proxy, you must load and enable mod_proxy_html.
path is the name of a local virtual path; url is a
partial URL for the remote server.
These parameters are used the same way as for the
ProxyPass directive.
For example, suppose the local server has address
http://example.com/; then
ProxyPass "/mirror/foo/" "http://backend.example.com/" ProxyPassReverse "/mirror/foo/" "http://backend.example.com/" ProxyPassReverseCookieDomain "backend.example.com" "public.example.com" ProxyPassReverseCookiePath "/" "/mirror/foo/"
will not only cause a local request for the
http://example.com/mirror/foo/bar to be internally converted
into a proxy request to http://backend.example.com/bar
(the functionality which ProxyPass provides here).
It also takes care of redirects which the server backend.example.com
sends when redirecting http://backend.example.com/bar to
http://backend.example.com/quux . Apache httpd adjusts this to
http://example.com/mirror/foo/quux before forwarding the HTTP
redirect response to the client. Note that the hostname used for
constructing the URL is chosen in respect to the setting of the UseCanonicalName directive.
Note that this ProxyPassReverse directive can
also be used in conjunction with the proxy feature
(RewriteRule ... [P]) from mod_rewrite
because it doesn't depend on a corresponding ProxyPass directive.
The optional interpolate keyword, used together with
ProxyPassInterpolateEnv, enables interpolation
of environment variables specified using the format ${VARNAME}.
Note that interpolation is not supported within the scheme portion of a
URL.
When used inside a <Location> section, the first argument is omitted and the local
directory is obtained from the <Location>. When used outside a <Location> or <LocationMatch> section, the
path argument is required. The same occurs inside a <LocationMatch> section, but will probably not work as
intended, as ProxyPassReverse will interpret the regexp literally as a
path; if needed in this situation, specify the ProxyPassReverse outside
the section or in a separate <Location> section.
This directive is not supported in <Directory> or <Files> sections.
ProxyPassReverseCookieDomain Directive ¶
| Description: | Adjusts the Domain string in Set-Cookie headers from a reverse- proxied server |
|---|---|
| Syntax: | ProxyPassReverseCookieDomain internal-domain
public-domain [interpolate] |
| Context: | server config, virtual host, directory |
| Status: | Extension |
| Module: | mod_proxy |
Usage is basically similar to
ProxyPassReverse, but instead of
rewriting headers that are a URL, this rewrites the domain
string in Set-Cookie headers.
ProxyPassReverseCookiePath Directive ¶
| Description: | Adjusts the Path string in Set-Cookie headers from a reverse- proxied server |
|---|---|
| Syntax: | ProxyPassReverseCookiePath internal-path
public-path [interpolate] |
| Context: | server config, virtual host, directory |
| Status: | Extension |
| Module: | mod_proxy |
Useful in conjunction with
ProxyPassReverse
in situations where backend URL paths are mapped to public paths on the
reverse proxy. This directive rewrites the path string in
Set-Cookie headers. If the beginning of the cookie path matches
internal-path, the cookie path will be replaced with
public-path.
In the example given with
ProxyPassReverse, the directive:
ProxyPassReverseCookiePath "/" "/mirror/foo/"
will rewrite a cookie with backend path / (or
/example or, in fact, anything) to /mirror/foo/.
ProxyPreserveHost Directive ¶
| Description: | Use incoming Host HTTP request header for proxy request |
|---|---|
| Syntax: | ProxyPreserveHost On|Off |
| Default: | ProxyPreserveHost Off |
| Context: | server config, virtual host, directory |
| Status: | Extension |
| Module: | mod_proxy |
| Compatibility: | Usable in directory context in 2.3.3 and later. |
When enabled, this option will pass the Host: line from the incoming
request to the proxied host, instead of the hostname specified in the
ProxyPass line.
This option should normally be turned Off. It is mostly
useful in special configurations like proxied mass name-based virtual
hosting, where the original Host header needs to be evaluated by the
backend server.
ProxyReceiveBufferSize Directive ¶
| Description: | Network buffer size for proxied HTTP and FTP connections |
|---|---|
| Syntax: | ProxyReceiveBufferSize bytes |
| Default: | ProxyReceiveBufferSize 0 |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
The ProxyReceiveBufferSize directive specifies an
explicit (TCP/IP) network buffer size for proxied HTTP and FTP connections,
for increased throughput. It has to be greater than 512 or set
to 0 to indicate that the system's default buffer size should
be used.
Example
ProxyReceiveBufferSize 2048
ProxyRemote Directive ¶
| Description: | Remote proxy used to handle certain requests |
|---|---|
| Syntax: | ProxyRemote match remote-server [username:password] |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
| Compatibility: | The optional third argument is usable only in httpd 2.4.59 and later. |
This defines remote proxies to this proxy. match is either the
name of a URL-scheme that the remote server supports, or a partial URL
for which the remote server should be used, or * to indicate
the server should be contacted for all requests. remote-server is
a partial URL for the remote server. Syntax:
remote-server =
scheme://hostname[:port]
scheme is effectively the protocol that should be used to
communicate with the remote server; only http and https
are supported by this module. When using https, the requests
are forwarded through the remote proxy using the HTTP CONNECT method.
Example
ProxyRemote "http://goodguys.example.com/" "http://mirrorguys.example.com:8000" ProxyRemote "*" "http://cleverproxy.localdomain" ProxyRemote "ftp" "http://ftpproxy.mydomain:8080"
In the last example, the proxy will forward FTP requests, encapsulated as yet another HTTP proxy request, to another proxy which can handle them.
This option also supports reverse proxy configuration; a backend webserver can be embedded within a virtualhost URL space even if that server is hidden by another forward proxy.
An optional third argument username:password may be given, which defines the Basic authentication credentials to pass to the configured remote proxy. The credentials will always be sent without first waiting for the remote proxy to send a Basic authentication challenge. The Proxy-Chain-Auth environment variable has no effect if this argument is used.
DNS resolution and forward proxies
When a forward (remote) proxy is configured, DNS resolution of
the origin/backend hostname is only performed on the forward proxy.
Any ProxyBlock rules
which restrict access to specific IP addresses must be configured
at the forward proxy.
ProxyRemoteMatch Directive ¶
| Description: | Remote proxy used to handle requests matched by regular expressions |
|---|---|
| Syntax: | ProxyRemoteMatch regex remote-server [username:password] |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
| Compatibility: | The optional third argument is usable only in httpd 2.4.59 and later. |
The ProxyRemoteMatch is identical to the
ProxyRemote directive, except that
the first argument is a regular expression
match against the requested URL.
ProxyRequests Directive ¶
| Description: | Enables forward (standard) proxy requests |
|---|---|
| Syntax: | ProxyRequests On|Off |
| Default: | ProxyRequests Off |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
This allows or prevents Apache httpd from functioning as a forward proxy
server. (Setting ProxyRequests to Off does not disable use of
the ProxyPass directive.)
In a typical reverse proxy or gateway configuration, this
option should be set to
Off.
In order to get the functionality of proxying HTTP or FTP sites, you
need also mod_proxy_http or mod_proxy_ftp
(or both) present in the server.
In order to get the functionality of (forward) proxying HTTPS sites, you
need mod_proxy_connect enabled in the server.
Warning
Do not enable proxying with ProxyRequests until you have secured your server. Open proxy servers are dangerous
both to your network and to the Internet at large.
See also
ProxySet Directive ¶
| Description: | Set various Proxy balancer or member parameters |
|---|---|
| Syntax: | ProxySet url key=value [key=value ...] |
| Context: | server config, virtual host, directory |
| Status: | Extension |
| Module: | mod_proxy |
| Compatibility: | ProxySet is only available in Apache HTTP Server 2.2 and later. |
This directive is used as an alternate method of setting any of the
parameters available to Proxy balancers and workers normally done via the
ProxyPass directive. If used
within a <Proxy balancer url|worker url>
container directive, the url argument is not required. As a side
effect the respective balancer or worker gets created. This can be useful
when doing reverse proxying via a
RewriteRule instead of a
ProxyPass directive.
<Proxy "balancer://hotcluster">
BalancerMember "http://www2.example.com:8080" loadfactor=1
BalancerMember "http://www3.example.com:8080" loadfactor=2
ProxySet lbmethod=bytraffic
</Proxy>
<Proxy "http://backend">
ProxySet keepalive=On
</Proxy>
ProxySet "balancer://foo" lbmethod=bytraffic timeout=15
ProxySet "ajp://backend:7001" timeout=15
Warning
Keep in mind that the same parameter key can have a different meaning depending whether it is applied to a balancer or a worker, as shown by the two examples above regarding timeout.
ProxySourceAddress Directive ¶
| Description: | Set local IP address for outgoing proxy connections |
|---|---|
| Syntax: | ProxySourceAddress address |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
| Compatibility: | Available in version 2.3.9 and later |
This directive allows to set a specific local address to bind to when connecting to a backend server.
ProxyStatus Directive ¶
| Description: | Show Proxy LoadBalancer status in mod_status |
|---|---|
| Syntax: | ProxyStatus Off|On|Full |
| Default: | ProxyStatus Off |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
| Compatibility: | Available in version 2.2 and later |
This directive determines whether or not proxy
loadbalancer status data is displayed via the mod_status
server-status page.
Note
Full is synonymous with On
ProxyTimeout Directive ¶
| Description: | Network timeout for proxied requests |
|---|---|
| Syntax: | ProxyTimeout seconds |
| Default: | Value of |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
This directive allows a user to specify a timeout on proxy requests. This is useful when you have a slow/buggy appserver which hangs, and you would rather just return a timeout and fail gracefully instead of waiting however long it takes the server to return.
ProxyVia Directive ¶
| Description: | Information provided in the Via HTTP response
header for proxied requests |
|---|---|
| Syntax: | ProxyVia On|Off|Full|Block |
| Default: | ProxyVia Off |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_proxy |
This directive controls the use of the Via: HTTP
header by the proxy. Its intended use is to control the flow of
proxy requests along a chain of proxy servers. See RFC 2616 (HTTP/1.1), section
14.45 for an explanation of Via: header lines.
- If set to
Off, which is the default, no special processing is performed. If a request or reply contains aVia:header, it is passed through unchanged. - If set to
On, each request and reply will get aVia:header line added for the current host. - If set to
Full, each generatedVia:header line will additionally have the Apache httpd server version shown as aVia:comment field. - If set to
Block, every proxy request will have all itsVia:header lines removed. No newVia:header will be generated.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.