Question

I have a Play! Application which needs to use HTTP and HTTPS. The application is running behind a proxy server (using Apache) that forwards web requests to the play application.

The proxy is using one port for HTTP requests, and another port that is intended for HTTPs requests. Note that the ports on the proxy are not the same ports as the ones used by the Play application (this is due to provider restrictions!).

The Play application is using the “standard” ports 9000 for HTTP and 9443 for HTTPs. The proxy receives HTTP requests on Port 8080 and forwards them to Play’s port 9000. The proxy receives HTTPs requests on Port 8090 and forwards them to Play’s port 9443.

My problem is that when I use the secure() method of making pages appear in Play, Play’s logic causes the app to attempt to use 9443 as the port for HTTPs. This causes the request to be lost because the proxy is using a different port.

The same appears to happen when I want to switch from HTTPs to HTTP. I cannot seem to make the system go to the port used by the proxy.

Somehow I need to make the system go to the ports known to the proxy server, without screwing up my routes. Is there some way to do this?

Thanks in advance for any help/insights.

Answer 1

I have found my own “answer”, though it is somewhat of a cludge.

It turns out that, based on what I can ascertain from the documentation, there really is no way to tell Play to switch between ports when a Play application is behind a proxy. This is because while Play does recognize the port that a request comes in on, it has no way of telling what proxy port it should use when going between secure and unsecure ports. It knows, for example, that an HTTP request comes through a proxy port 8080, and it knows that subsequent requests to its port 9000 will come from that proxy port. What it does not know to do is to switch to another proxy port when someone attempts to use https to access its port 9443. Consequently, if you have a page like
http://toproxy:8080/links that has one or more links that use the secure() method to activate https, then Play will resolve the link to be https://toproxy:8080 — despite the fact that the proxy server may want to use port 8090 for HTTPS requests. Because proxy port 8080 is redirected to Play’s port 9000, use of that port for HTTPS requests always fails. This is true in Play 2.0 as well as Play 1.X.

I believe that Play needs some standard configuration parameter that can tell it to map proxy ports to its HTTP and HTTPS ports. That way, when it is behind a proxy server a developer can use the secure() method and Play will be able to resolve the URL to the correct proxy port. This capability should be available in 1.X as well as Version 2.

Until someone actually implements this (I might if I ever get the time, but with all that I am committed to do people shouldn’t hold their breath), my cludge is to simply use the rediirect() method to switch between HTTP and HTTPS proxy ports. The redirect() method apparently allows us to enter full URLs, so I simply call the full URL of the page that I switch requests on.

For example: in the aforementioned page http://toproxy:8080/links, I may have a link to a login page that I want to protect using HTTPS. To do this I create two actions: one for the redirect to the proxy HTTPS port (for this example, call it gotoLogin()) and another for actually rendering the login page (for this example, call it loginPage() and give it a route of /loginpage).

In gotoLogin() I redirect to loginPage in the following manner:

redirect(“https://toproxy:8090/loginpage”);

This makes Play come in on proxy port 8090, which is redirected to Play’s port 9443.

When the user properly logs in, my authentication action simply uses another redirect() call:

redirect(“http://toproxy:8080/destination_page”);

This causes Play to go back to the proper proxy port for unsecured requests.

This is not the best solution for this problem. There is a possibility that the proxy server can be somehow configured to make the proper switch between HTTP and HTTPS ports, but investigating this may take some time for someone not an expert in proxy server configuration (which describes me!). Of course, the best solution would be to implement in Play the kind of proxy port handling that I have previously described.

But this solution works and can be adapted to many different situations. Unless someone comes up with another better solution, this solution is the one I am using.