Mailing-List: contact users-help@tapestry.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tapestry users" <users@tapestry.apache.org>
MIME-Version: 1.0
In-Reply-To: <AM4PR0801MB1540A67332C64D9BCFC5E6FFD20A0@AM4PR0801MB1540.eurprd08.prod.outlook.com>
References: <AM4PR0801MB15409B121BABD4429B4C2FCFD2090@AM4PR0801MB1540.eurprd08.prod.outlook.com>
 <CAGSzHa3Ud84HzCaM+HfCwZMj1eKOpomk5bibR3zAJeFSEz42Og@mail.gmail.com>
 <CAFKtUSsdLU50Lbkbs3z=5JdT0Y2wYmg-nrEc83H9s2xmV5AQDw@mail.gmail.com>
 <AM4PR0801MB1540FD4F9ACD503774983B37D20A0@AM4PR0801MB1540.eurprd08.prod.outlook.com>
 <D684694E-E880-4C31-A465-D6DED7E182BC@gmail.com> <AM4PR0801MB1540A67332C64D9BCFC5E6FFD20A0@AM4PR0801MB1540.eurprd08.prod.outlook.com>
From: Dimitris Zenios <dimitris.zenios@gmail.com>
Date: Fri, 22 Jul 2016 15:50:32 +0300
Message-ID: <CAGSzHa3UB5YJpNtZCZUaf+qiyvqbBiobVQqHyq5ExMjYFi2Kwg@mail.gmail.com>
Subject: Re: TLS termination proxy and Tapestry
To: Tapestry users <users@tapestry.apache.org>
Content-Type: multipart/alternative; boundary=001a11489f349ad942053838e3f5
archived-at: Fri, 22 Jul 2016 12:51:18 -0000

--001a11489f349ad942053838e3f5
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

This  is a snippet of nginx configuration that proxies the request to jetty
on port 8080.Via this configuration i am able to have ssl and non ssl
versions of the tapestry application.If i want to enforce only ssl version
of tapestry i enforce it via nginx.Hope that was helpful

    location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass       http://127.0.0.1:8080;
    }


On Fri, Jul 22, 2016 at 3:31 PM, Svein-Erik L=C3=B8ken <svein@jacilla.no> w=
rote:

> With my configuration with -Dtapestry.secure-enabled=3Dtrue the private
> String org.apache.tapestry5.internal.services.
> LinkImpl::buildURI(LinkSecurity security) return the absolute URI.
>
> Using:
>
>         public void contributeMetaDataLocator(MappedConfiguration<String,
> String> configuration) {
>                 configuration.add(MetaDataConstants.SECURE_PAGE, "true");
>         }
> With -Dtapestry.secure-enabled=3Dtrue also works.
>
> Still need to set X-Forwarded-Proto=3D"https" to have request.isSecure()
> return true.
>
> Which one is the preferred method?
>
> S-E
>
>
>
> From: JumpStart [via Apache Tapestry Mailing List Archives] [mailto:
> ml-node+s1045711n5732786h47@n5.nabble.com]
> Sent: 22. juli 2016 13:24
> To: Svein-Erik L=C3=B8ken <svein@jacilla.no>
> Subject: Re: TLS termination proxy and Tapestry
>
> When you say you are avoiding absolute URLs, where have you noticed this?
> I can=E2=80=99t recall this being a problem.
>
> Now, I=E2=80=99m no expert on this kind of configuration, and its a while=
 since I
> set this all up, so forgive me if I have my wires crossed. Also, our site=
=E2=80=99s
> load is small so far but growing so all of this will be up for review soo=
n.
>
> In production we run pure HTTPS. We force all HTTP traffic to HTTPS by
> setting this in AppModule:
>
>         public void contributeMetaDataLocator(MappedConfiguration<String,
> String> configuration) {
>                 configuration.add(MetaDataConstants.SECURE_PAGE, "true");
>         }
>
> We=E2=80=99re using mod_proxy and mod_ssl in Apache, no HAProxy. So Apach=
e is
> terminating the SSL/TLS.
>
> We use:
>
>         -Dtapestry.secure-enabled=3Dtrue
>
> We tell mod_proxy this:
>
>         ProxyPreserveHost On
>
> and we use the following to convert the request to AJP, because app
> preserves the HTTPS headers.
>
>         ProxyPass /myapp ajp://app:8009/myapp retry=3D5
>         ProxyPassReverse /myapp ajp:app:8009/myapp retry=3D5
>
> This all works great for us. So what=E2=80=99s the URL issue again?
>
> Geoff
>
>
>

--001a11489f349ad942053838e3f5--