Using Apache as proxy results in occasional 403

General
1

Hi, I’m trying to configure Apache in order to serve as a proxy for my VAADIN (version 7.3.6) application that’s deployed on a Tomcat server.

The configuration seemed to work just fine at first. I can login and use the app. However, after a few clicks within the application, VAADIN comes up with a notification:
“UIDL could not be read from server. Check servlets mapping. Error code: 403”.

After this message appears and I try to reload the page (Hitting F5 in the browser) I can’t access the webapp at all anymore, resulting in a 403 error. When I wait for a few seconds and reload the entire page again (F5), I can access the webapp again. A few clicks after successful login result in the same situation over and over again.

When the error appears the following lines are found in the Apache error log:

  1. (When still in the application)
    [error]
    client denied by server configuration: proxy:http://172.16.1.107:8080/UIDL/, referrer: https://www.mydomain.ch/

  2. (After hitting F5 and the page is denied completely)
    [error]
    client denied by server configuration: proxy:http://172.16.1.107:8080/

Apache configuration as follows: (The site is supposed to be served as HTTPS only)

<VirtualHost *:80>
  ServerName www.mydomain.ch
 
  HostnameLookups Off
  UseCanonicalName Off

  ProxyRequests Off

  Redirect /VAADIN/    https://www.mydomain.ch/VAADIN/
  Redirect /UIDL/    https://www.mydomain.ch/UIDL/
  Redirect /        https://www.mydomain.ch/
</VirtualHost>


<VirtualHost _default_:443>
  SSLEngine on
  SSLProxyEngine on
  SSLCertificateFile ...
  SSLCertificateKeyFile ...

  SSLProtocol all -SSLv2
  SSLHonorCipherOrder On
  SSLCipherSuite ...
  SetEnv no-gzip

  ServerName www.mydomain.ch
  ProxyRequests Off

  ProxyPass /VAADIN/    http://172.16.1.107:8080/VAADIN/
  ProxyPass /UIDL/    http://172.16.1.107:8080/UIDL/
  ProxyPass /        http://172.16.1.107:8080/

  ProxyPreserveHost on
  ProxyPassReverseCookiePath / /

  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

</VirtualHost>
2

buddy, and what about using mod_jk instead?

Cheers,

3

Well, I also tried using mod_proxy_ajp…
Using AJP I get the same problem, the logfile looks as following:
[error]
client denied by server configuration: proxy:ajp://172.16.1.107:8009/UIDL/, referrer: https://www.mydomain.ch

4

I had the same problem with a http to https rewrite rule (occasional = many requests, for example resizing a browser window with a v-leaflet map). I had to deactivate mod-evasive (Dos/DDoS prevention):

a2dismod mod-evasive
service apache2 restart

Changing the configuration for mod-evasive could also help…
Cheers,