title: REST API generating absolute URLs behind reverse proxy
body: <p><strong>Situation</strong></p>
  <p>I have a REST API in place that returns JSON objects to its clients. Part of said JSON responses are absolute URLs to other &quot;linked&quot; resources/objects of the form &quot;http://myservice.com/servicePath/apiVersionA/123&quot;. In the example URL &quot;servicePath&quot; is the web root of my service, &quot;apiVersionA&quot; is the specific version of the REST API being used, and &quot;123&quot; is the identifier of the actual resource. The fact that my API is returning absolute resource URLs in the response body is prescribed by the protocol I'm using, I am not at liberty to change that.</p>
  <p><strong>Problem</strong>
  The problem I'm facing now are reverse proxies, and more specifically how I assume they handle request patterns like the following:</p>
  <ol>
  <li>Client sends request &quot;GET <a href="http://myproxy.com/rest/apiVersionA/123%22" rel="nofollow noreferrer">http://myproxy.com/rest/apiVersionA/123&quot;</a> to the Reverse Proxy.</li>
  <li>Reverse Proxy forwards the request to its final destination: &quot;GET <a href="http://myservice.com/servicePath/apiVersionA/123%22" rel="nofollow noreferrer">http://myservice.com/servicePath/apiVersionA/123&quot;</a>. Please note that the proxy modifies both the host name and the URL path (&quot;rest&quot; is changed to &quot;servicePath&quot;) of the request.</li>
  </ol>
  <p>AFAIK, the usual suspects (i.e. HTTP headers &quot;Forwarded&quot;, &quot;X-Forwarded-For&quot;, &quot;X-Forwarded-Host&quot; etc.) only contain either IP addresses or domain names, but not the entire URL path. So right now in the best case scenario I can generate URLs like &quot;http://myproxy.com/apiVersionA/123&quot; - notice the missing &quot;rest&quot; URL path element that is required by the proxy. This URLs will thus not be accepted by the proxy in a subsequent request made by the client, e.g. to retrieve a resource that is referenced in the response message.</p>
  <p><strong>Questions</strong></p>
  <ol>
  <li>Is there an obvious proxy-safe HTTP header I am missing that would deliver the original request URL to the actual REST API service?</li>
  <li>If not, is there another way how I can generate correct absolute URLs in my service?</li>
  </ol>
  <p>So far I have thought about using a custom HTTP header (which might get removed by an intermediate proxy), or by using something like <a href="https://httpd.apache.org/docs/2.4/mod/mod_substitute.html" rel="nofollow noreferrer">https://httpd.apache.org/docs/2.4/mod/mod_substitute.html</a> on the reverse proxy (which I'd say is not possible as I do not control the networking infrastructure of my customers or any intermediaries). Another &quot;non-solution&quot; that I came up with is to document this as part of my API: &quot;do not use custom URL path elements on your HTTP proxies&quot;. This would allow me to generate URLs using just X-Forwarded-Host and X-Forwarded-Proto.</p>
  <p>Any help is appreciated!</p>