3

In my website I have Cross Domains Requests with sometimes, HTTP 302 reponses.

I want to do two things:

  • for HTTP OPTIONS requests: HTTP code 200, no follow redirect
  • for HTTP POST, GET requests: Follow a new URL and execute all 302 if needed.

As urls to follow with get and post are various (multiple API) I did something like that:

http://myproxyurl.com?service=http://myapi.com (with myapi.com URL encoded)

Here is my proxy vhost:

<VirtualHost *:80>
  DocumentRoot "C:/..."
  ServerName http://myproxyurl.com

  Header always set Access-Control-Allow-Origin "*"
  Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS"
  Header always set Access-Control-Max-Age "1000"
  Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"

  RewriteEngine on
  RewriteCond %{REQUEST_METHOD} OPTIONS
  RewriteRule ^(.*)$ $1 [R=200,L]

  RewriteCond %{QUERY_STRING} ^service=(.*)
  RewriteRule (.*) $1 [R,L]
</VirtualHost>

But with it I have redirect loop on chrome like this: Chrome network tab screen shot

How can I fix this rediect loop? I'm open to better solution than "?service=" if any.

Thanks for help.

EDIT: New Vhost conf

With : Mod-proxy with query string alternatives? I'm close to solution... but still get a code 500

<VirtualHost *:80>
  LogLevel alert rewrite:trace8
  DocumentRoot "C:/..."
  ServerName myproxyurl.com
  Header always set Access-Control-Allow-Origin "*"
  Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS"
  Header always set Access-Control-Max-Age "1000"
  Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
  AllowEncodedSlashes On
  RewriteEngine on
  RewriteCond %{REQUEST_METHOD} OPTIONS
  RewriteRule ^(.*)$ $1 [R=200,L]

  RewriteMap unescape int:unescape

  RewriteCond %{QUERY_STRING} ^service=(.*)$
  RewriteRule ^/ ${unescape:%1} [P,L]


</VirtualHost>
Community
  • 1
CyrilleGuimezanes
  • 131

1 Answers1

0

Final VHOST:

<VirtualHost *:80>
    DocumentRoot "C:/..."
    ServerName myproxyurl.com
    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS"
    Header always set Access-Control-Max-Age "1000"
    Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"

    RewriteEngine on
    RewriteCond %{REQUEST_METHOD} OPTIONS
    RewriteRule ^(.*)$ $1 [R=200,L]

    RewriteMap unescape int:unescape

    RewriteCond %{QUERY_STRING} ^service=(.*)$
    RewriteRule ^/ ${unescape:%1} [P,NE,R=302,L]

</VirtualHost>

Not sure if all these lines/flags are required, but, I get the results!

You have to enable these apache modules:

  • mod_rewrite
  • proxy_module
  • proxy_http_module
  • headers_module

Good to know: I read that this method is not secured because anyone can place any URL in service param ... in my case I can trust users.

CyrilleGuimezanes
  • 131