title: Tomcat behind Apache behind Firewall: AJP ignores X-Forwarded-Proto
body: <p>We have following setup in case of https traffic:</p>
  
  <ul>
  <li>Firewall: terminates https, adds "X-Forwarded-Proto: https", forwards to Apache via http</li>
  <li>Apache: forwards to Tomcat through AJP</li>
  <li>Tomcat: receives request via AJP-connector</li>
  </ul>
  
  <p>We have added the RemoteIpValve to Tomcat's server.xml:</p>
  
  <pre><code>&lt;Valve className="org.apache.catalina.valves.RemoteIpValve"
                     remoteIpHeader="x-forwarded-for"
                     protocolHeader="x-forwarded-proto"
              /&gt;
  </code></pre>
  
  <p>It works if we skip Apache and forward straight from the firewall to Tomcat with a regular HTTP-Connector. In that case Tomcat uses https for redirect and base urls.</p>
  
  <p>But once we go through Apache and AJP, the X-Forwarded-Proto header seems to be ignored. We checked, the X-Forwarded-Proto header is still present on Tomcat's request.</p>
  
  <p>I guess Tomcat is told through AJP which front-end protocol is used (http or https). Maybe this doesn't happen? Do we need to tell Apache somehow to consider X-Forwarded-Proto for AJP?</p>
  
  <p>Apache VirtualHost configuration:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
      ServerName www.myserver.biz
  
      JkMount /* LoadBalancerHD
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>workers.properties:</p>
  
  <pre><code>worker.list=LoadBalancerHD
  
  worker.LoadBalancerHD.balance_workers=HDNode1,HDNode2
  worker.LoadBalancerHD.type=lb
  worker.LoadBalancerHD.sticky_session=True
  
  worker.HDNode1.type=ajp13
  worker.HDNode1.host=webserver01
  worker.HDNode1.port=8010
  worker.HDNode1.distance=0
  
  worker.HDNode2.type=ajp13
  worker.HDNode2.port=8010
  worker.HDNode2.host=webserver02
  worker.HDNode2.distance=1
  </code></pre>