Apache反向代理和Wicket CsrfPreventionRequestCycleListener

Question

[org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener] 
(default task-12) Possible CSRF attack, request URL: 
 http://example.com/example/portal/wicket/page, 
 Origin: https://example.com, action: aborted with error 
 400 Origin does not correspond to request

<VirtualHost example.com:443>
ServerName example.com
LogLevel debug
SSLEngine On
SSLCertificateFile             /var/example/example.com/signed.crt
SSLCertificateKeyFile          /var/example/example.com/domain.key
SSLCACertificateFile           /var/example/example.com/intermediate.pem

SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
SSLOpenSSLConfCmd DHParameters "/usr/local/apache2/1024dhparams.pem"

SSLProxyEngine on
ProxyPass        / http://localhost:8390/ timeout=600
ProxyPassReverse / http://localhost:8390/ timeout=600
ProxyPreserveHost On

Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Credentials "true"
Header edit Location ^http(\:\/\/.*)$ https$1

我们发现了一个使用http2的解决方案，但更喜欢不使用http2的解决方案（出于原因，请参见https://http2.pro/doc/apache）。

使用http2的Apache工作配置

<VirtualHost example.com:443>
ServerName example.com
LogLevel debug
SSLEngine On
SSLCertificateFile             /var/example/example.com/signed.crt
SSLCertificateKeyFile          /var/example/example.com/domain.key
SSLCACertificateFile           /var/example/example.com/intermediate.pem
SSLProtocol +TLSv1.2 +TLSv1.1 +TLSv1
SSLOpenSSLConfCmd DHParameters "/usr/local/apache2/1024dhparams.pem"

SSLProxyEngine On
ProxyPreserveHost On

# Settings for http2 communication
Protocols h2 http/1.1
ProxyPass   / https://localhost:8754/ timeout=600
ProxyPassReverse    / https://localhost:8754/ timeout=600
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off 

Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Credentials "true"
# Header edit Location ^http(\:\/\/.*)$ https$1
</VirtualHost>

有人能帮助我们创建一个有效的apache反向代理配置，该配置与CsrfPreventionRequestCycleListener一起工作而不使用http2模块吗？

Answer 1

我想我在这里有一个类似的问题，刚刚解决了。我想你现在可能已经解决了你的问题，但也许其他人正在为这个话题而倾倒。

您可能希望查看网络转储以验证问题。对我来说，apache将请求发送到本地运行的服务（您的情况是http://localhost:8754)，而一些请求头仍然引用公共名称https://example.com。检测到这是一个安全风险，连接被基础服务拒绝。

我确保在apache中启用了mod_headers并添加了一行

RequestHeader edit Referer "https://example.com" "http://localhost:8754"