So you just finished your first Play! App. You want to run that thing behind an Apache2 as a HTTPS Proxy, because you do not want, that your User-Credentials are read as clear text.
So a very basic Apache Configuration looks like this:
<IfModule mod_ssl.c> Listen 443 SSLRandomSeed startup builtin SSLRandomSeed connect builtin <VirtualHost _default_:443> SSLEngine on ServerName example.com ServerAdmin admin@example.com ErrorLog /var/log/apache2/ssl_error_log SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateFile /etc/apache2/ssl/example/newcert.pem SSLCertificateKeyFile /etc/apache2/ssl/example/webserver.nopass.key SSLCACertificateFile /etc/apache2/ssl/demoCA/cacert.pem SSLCARevocationPath /etc/apache2/ssl/certs/demoCA/crl ProxyPass /play http://127.0.0.1:9000/play ProxyPassReverse /play http://127.0.0.1:9000/play </VirtualHost> </IfModule>
I did already explained how to run a Play! Application within a Application Context. Here our Context is just “play”, but you can set it to something else. You can also change and add seperate instances with different ports (over 9000!!!).
You should alter two settings in your conf/application.conf
# you need to add this
context=/play
# you need to uncomment this to prevent Play! from serving aside your Apache2 Proxy
http.address=127.0.0.1
# you may uncomment and change this port number for chaning it
# http.port=9000
Time for a Test Run. At a first glance it seems to work pretty nice. But as soon as you want to use the nifty routing redirects from Play!, the whole system breaks, because Play! still things, it runs in plain http on port 9000. To solve this, you need to change to things:
- Make Apache2 to send a specific header, that the Request was send through a Proxy
- Make Play! to fix the redirect to the correct URL
The first part is pretty easy. Just add
RequestHeader set X_FORWARDED_PROTO 'https'
within your VirtualHost Tag – you may need to enable the headers module first to make that work.
The second part is a little bit more difficult. You have to add a before filter to your application controller:
public class Application extends Controller {
@Before
private static void checkSSL() {
if (request.headers.get("x_forwarded_proto") != null
&& "https".equals(request.headers.get("x_forwarded_proto").value())) {
request.secure = true;
request.port = 443;
}
if (request.headers.get("x-forwarded-server") != null) {
request.domain = request.headers.get("x-forwarded-server").value();
}
}
...
}
You can find the sources on GitHub.
B.t.w. the same problem also might appears in Rails Apps, i might write about this later on.