Changing credentials to a proxy server on the fly

I'm developing an extension for chrome. The extension allow to pick any proxy server from a list each proxy is required authorization. There is an issue when a user would like to connect to the same proxy server twice but with different credentials for example if a user was successfully logged it in the first time the chome remebers it and when the user whould try to connect with another credentails the chrome whould use credentilas that was inputed in the first login.

var authCredentials = {   username: 'Jack',   password: 'PassForJack' }  var auth = function () {     return {        authCredentials     }; };   chrome.webRequest.onAuthRequired.addListener(auth, {    urls: ["<all_urls>"]  }, ["blocking"]);  // set a new proxy server for the first login chrome.proxy.settings.set({   value: {       mode: 'fixed_servers',       rules: {         singleProxy: {             host: 'some-proxy-server.com',             port: 8000         }     }   },   scope: 'regular' });   // change credentails  authCredentials = {   username: 'Bob',   password: 'PassForBob' };  // remove proxy configuration chrome.proxy.settings.set({   value: {     mode: 'direct'   },   scope: 'regular' });  // remove onAuthListener chrome.webRequest.onAuthRequired.removeListener(auth) chrome.webRequest.onAuthRequired.hasListener(auth) // returns false  chrome.webRequest.onAuthRequired.addListener(auth, {    urls: ["<all_urls>"]  }, ["blocking"]);  // lets re connect  chrome.proxy.settings.set({   value: {     mode: 'fixed_servers',     rules: {         singleProxy: {             host: 'some-proxy-server.com',             port: 8000         }     }   },   scope: 'regular' });  // that doesn't help the user would be loged as "Jack" but has to be as "Bob" 

1 Answers

Answers 1

There are multiple possibilities here since the question is not very clear. I would suggest to walk through documentation for the chrome.webRequest first. But My question would be why don't you use interceptor method to check for server-credential pair ? There's a good article about adding interceptor in the background.js script of your extension which suggests to use the beforeRequest hook.

Read More

Eclipse: Native proxy setting goes missing, breaking network connectivity

For no discernible reason, the native proxy provider (see pic) of my Eclipse (Photon 4.8) sometimes goes missing. This results in Eclipse no longer having internet access. I have not found a way to add this provider again except restarting Eclipse.

My main two questions are: Can I add this provider again once it goes missing? What could be the reason why it vanishes in the first place?

2 Answers

Answers 1

At the bottom of the Network Connections dialog, you should see a Restore Defaults button. For most cases, that should suffice.

Answers 2

This problem occurs when using some photon versions. I had the same problem, but I downgrade version and everything was fine. There is a reporting bug in Click bugzilla.

If this problem persists, report your case. Nothing can be done to fix the problem at runtime.

Read More

POSTMAN sync not working behind a network proxy

I'm running POSTMAN sync (sync data across devices) behind a network proxy and it is not working. Apparently it's not honoring the global proxy configuration in my system. Login in and upload is working fine. Only the sync has the issue. I'm using Ubuntu 14.04 LTS 64bit Chrome Version 47.0.2526.106 (64-bit) Postman version 3.2.9

I have also tried restarting and reinstalling POSTMAN with no luck.

1 Answers

Answers 1

The most likely cause is that your proxy does not allow websocket connections that Postman sync uses for data synchronization. Check for error messages in Postman's DevTools window

Here is a good description of how to debug this issue.

Read More

Proxy Pooling System for Scrapy to temporarily stop using slow/timing out proxies

I've been looking around trying to find a decent pooling system for Scrapy but I can't find anything that has everything I need/want.

I'm looking for a solution to:

Rotate proxies

• I'd like them randomly switch between proxies but never selecting the same proxy twice in a row. (Scrapoxy has this)

Impersonate Known Browsers

• Impersonate Chrome, Firefox, Internet Explorer, Edge, Safari... etc (Scrapoxy has this)

Blacklist Slow Proxies

• If the proxy times out or is slow it should be blacklisted through a series of rules... (Scrapoxy only has blacklisting for number of instances / startups)

• If a proxy is slow (takes over x time) it should be marked as Slow and a timestamp should be taken and a counter should be increased.

• If a proxy timeout's it should be marked as Fail and a timestamp should be taken and a counter should be increased.
• If a proxy has no slows for 15 minutes after receiving its last slow then the counter & timestamp should be zeroed and the proxy gets returns back to a fresh state.
• If a proxy has no fails for 30 minutes after receiving its last fail then the counter & timestamp should be zeroed and the proxy gets returns back to a fresh state.
• If a proxy is slow 5 times in 1 hour then it should be removed from the pool for 1 hour.
• If a proxy timeout's 5 times in 1 hour then it should be blacklisted for 1 hour
• If a proxy get's blocked twice in 3 hours it should be blacklisted for 12 hours and marked as bad
• If a proxy gets marked as bad twice in 48 hours then it should notify me (email, push bullet... anything)

Anyone know of any such solution (the main feature being the blacklisting of slow/timed out proxies...

1 Answers

Answers 1

As your polling rules are very specifics, you may code your own, please see the code bellow which implement some part of your rules (you have to implement some other):

#!/usr/bin/env python # -*- coding: UTF-8 -*-  import pexpect,time from random import shuffle  #this func is use to test a single proxy def test_proxy(ip,port,max_timeout=1):     child = pexpect.spawn("telnet " + ip + " " +str(port))     time_send_request=time.time()     try:         i=child.expect(["Connected to","Connection refused"], timeout=max_timeout) #max timeout in seconds     except pexpect.TIMEOUT:         i=-1     if i==0:         time_request_ok=time.time()         return {"status":True,"tim#!/usr/bin/env python # -*- coding: UTF-8 -*-e_to_answer":time_request_ok-time_send_request}     else:         return {"status":False,"time_to_answer":max_timeout}   #this func is use to test all the current proxy and update status and apply your custom rules def update_proxy_list_status(proxy_list):     for i in range(0,len(proxy_list)):         print ("testing proxy "+str(i)+" "+proxy_list[i]["ip"]+":"+str(proxy_list[i]["port"]))         proxy_status = test_proxy(proxy_list[i]["ip"],proxy_list[i]["port"])         proxy_list[i]["status_ok"]= proxy_status["status"]           print proxy_status          #here it is time to treat your own rule to update respective proxy dict          #~ If a proxy is slow (takes over x time) it should be marked as Slow and a timestamp should be taken and a counter should be increased.         #~ If a proxy timeout's it should be marked as Fail and a timestamp should be taken and a counter should be increased.         #~ If a proxy has no slows for 15 minutes after receiving its last slow then the counter & timestamp should be zeroed and the proxy gets returns back to a fresh state.         #~ If a proxy has no fails for 30 minutes after receiving its last fail then the counter & timestamp should be zeroed and the proxy gets returns back to a fresh state.         #~ If a proxy is slow 5 times in 1 hour then it should be removed from the pool for 1 hour.         #~ If a proxy timeout's 5 times in 1 hour then it should be blacklisted for 1 hour         #~ If a proxy get's blocked twice in 3 hours it should be blacklisted for 12 hours and marked as bad         #~ If a proxy gets marked as bad twice in 48 hours then it should notify me (email, push bullet... anything)                  if proxy_status["status"]==True:             #modify proxy dict with your own rules (adding timestamp, last check time, last down, last up eFIRSTtc...)             #...             pass         else:             #modify proxy dict with your own rules (adding timestamp, last check time, last down, last up etc...)             #...             pass              return proxy_list   #this func select a good proxy and do the job def main():      #first populate a proxy list | I get those example proxies list from http://free-proxy.cz/en/     proxy_list=[         {"ip":"167.99.2.12","port":8080}, #bad proxy         {"ip":"167.99.2.17","port":8080},         {"ip":"66.70.160.171","port":1080},         {"ip":"192.99.220.151","port":8080},         {"ip":"142.44.137.222","port":80}         # [...]     ]        #this variable is use to keep track of last used proxy (to avoid to use the same one two consecutive time)     previous_proxy_ip=""      the_job=True     while the_job:          #here we update each proxy status         proxy_list = update_proxy_list_status(proxy_list)          #we keep only proxy considered as ok         good_proxy_list = [d for d in proxy_list if d['status_ok']==True]          #here you can shuffle the list         shuffle(good_proxy_list)          #select a proxy (not same last previous one)         current_proxy={}         for i in range(0,len(good_proxy_list)):             if good_proxy_list[i]["ip"]!=previous_proxy_ip:                 previous_proxy_ip=good_proxy_list[i]["ip"]                 current_proxy=good_proxy_list[i]                 break          #use this selected proxy to do the job         print ("the current proxy is: "+str(current_proxy))          #UPDATE SCRAPY PROXY          #DO THE SCRAPY JOB         print "DO MY SCRAPY JOB with the current proxy settings"          #wait some seconds         time.sleep(5)  main() 

Read More

Alert(Level: Fatal, Description: Decode Error) - Forwarding Proxy

I'm trying to make a forwarding proxy but I keep getting an

Alert(Level: Fatal, Description: Decode Error) 

after the Client sends...

Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message 

Any ideas as to what I'm doing wrong?

I can't seem to get a grasp on what the error even means. Does it mean the initial encrypted packet by the client fails to be decrypted by the server? If so, then why?

UPDATE 1

I just was looking at the packets and I noticed a significant difference between using my proxy, and not using the proxy.

The DFE key isn't being interpereted with my proxy.

1 Answers

Answers 1

Any ideas as to what I'm doing wrong?

You're not forwarding the exact amount of data that the proxy is supposed to forward.

But I see you're going further now than at the beginning of your question (good !)

You are implementing a proxy which forwards every single byte which it receives, in both ways, and either it sends too much to the server, or not enough. Check your code again for any conditions when you stop reading the input data to forward, be sure you're forwarding exactly everything. Nothing more, nothing less.

RFC 5246, about Decode Error :

decode_error A message could not be decoded because some field was out of the specified range or the length of the message was incorrect. This message is always fatal and should never be observed in communication between proper implementations (except when messages were corrupted in the network).

Read More

Nginx 502 Bad Gateway error when using proxy

i have a Angular build and an Laravel backend providing API's running on one server. I've configured them in nginx with the frontend having a proxy to the backend server.

The backend is running on the url (example is placeholder) http://api.example.com and the frontend is running on http://example.com

Frontend config:

server {     listen       80;     server_name  example.com;      location /api {         proxy_pass http://api.example.com;         proxy_http_version 1.1;         proxy_set_header Upgrade $http_upgrade;         proxy_set_header Connection "upgrade";         proxy_set_header Host $host;     }      location / {         root  /var/www/angular/em-frontend/dist;         index  index.html index.htm;         try_files $uri $uri/ /index.html$is_args$args;     } } 

Backend config:

server {         listen 80;         server_name api.example.com;          root /var/www/angular/em-backend/public;          index index.php index.html index.htm;          location / {                 # First attempt to serve request as file, then                 # as directory, then fall back to displaying a 404.                 try_files $uri $uri/ /index.php?$query_string;                 # Uncomment to enable naxsi on this location                 # include /etc/nginx/naxsi.rules         }         location ~ \.php$ {                 try_files $uri =404;                 fastcgi_split_path_info ^(.+\.php)(/.+)$;                 fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;                 fastcgi_index index.php;                 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;                 include fastcgi_params;         } } 

Now when I do any api call from the frontend I get the a 502 Bad Gateway error from nginx.

From nginx error log:

2017/12/09 23:30:40 [alert] 5932#5932: 768 worker_connections are not enough 2017/12/09 23:30:40 [error] 5932#5932: *770 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: IP_MASKED, server: example.com, request: "GET /api/endpoint HTTP/1.1", upstream: "http://IP_ADDRESS:80/api/endpoint", host: "example.com", referrer: "http://example.com/dashboard" 

Any idea how I can fix this?

2 Answers

Answers 1

you must use proxy-pass in location block like this example:

upstream myproject {    server ip1 ;    server ip2 ;    server ip3 ;  }  location / {     proxy_pass      http://myproject; } 

Answers 2

I believe your issue is hostname configuration creating a recursive loop in which a single request is proxied back to the front-end quickly exhausting all workers. You'll recognize this by a single request to the frontend generating many entries in the access log.

I was able to quickly recreate that error using the config you provided. Below is a modified version that eliminates config serving up 2 different static files on backend server to illustrate the minimum config required. If this works, you can add the cgi_pass config back in.

#set api domain to use alternate port, could also just tack onto proxy_pass. upstream api.example.com {     server localhost:8081; }  #frontend listening on port 8080 server {     listen       8080;     server_name  example.com;      location /api {         proxy_pass http://api.example.com;         proxy_http_version 1.1;         proxy_set_header Upgrade $http_upgrade;         proxy_set_header Connection "upgrade";         proxy_set_header Host $host;     }      location / {         root  /usr/local/var/www;         index  index.html index.htm;         try_files $uri $uri/ /index.html$is_args$args;     } }  #backend listening on 8081 server {         listen 8081;         server_name api.example.com;          index index.php index.html index.htm;          location / {  # will match any url not ending in .php               root  /usr/local/var/www;               try_files $uri $uri/ /index.html;         }         location ~ \.php { #successfully responds to http://example.com:8080/api/*.php               root  /usr/local/var/www;               try_files $uri $uri/ /service.html;         } } 

Read More

Apache Forward Proxy With SSL Termination

I'm trying to set up an Apache Forward Proxy that terminates the SSL connection. The reason I'm trying to do this is to run Apache filters (specifically mod_pagespeed) on the returned code. Before I deal with mod_pagespeed, I'm testing this POC by trying to insert a header into the response (which will prove that I can edit the response), but I'm having issues with SSL proxying (non-SSL proxying works fine).

Note that I'm not concerned about any certificate errors or the like -- this is purely for internal testing.

I've got the server set up and see the X-MSCProxy Header on a non-SSL page:

jshannon-macbookpro:pagespeed_proxy jshannon$ curl -vv --proxy pagespeed_proxy:3ja82ad9@localhost:8080 -D - -o /dev/null http://www.slate.com  * TCP_NODELAY set * Connected to localhost (::1) port 8080 (#0) * Proxy auth using Basic with user 'pagespeed_proxy' > GET http://www.slate.com/ HTTP/1.1 > Host: www.slate.com ... >  < HTTP/1.1 200 OK HTTP/1.1 200 OK < Date: Mon, 30 Oct 2017 18:10:40 GMT Date: Mon, 30 Oct 2017 18:10:40 GMT < Server: Apache/2.2.29 (Amazon) Server: Apache/2.2.29 (Amazon) ... < Content-Length: 187051 Content-Length: 187051 ... < X-Instart-Request-ID: 8286987369135064135:FWP01-NPPRY22:1509387040:0 X-Instart-Request-ID: 8286987369135064135:FWP01-NPPRY22:1509387040:0 < Via: 1.1 172.17.0.2:8080 Via: 1.1 172.17.0.2:8080 < X-MSCProxy: SansPS X-MSCProxy: SansPS 

But when I make the same request to Slate's SSL page I don't see my proxy:

jshannon-macbookpro:pagespeed_proxy jshannon$ curl -vv --proxy pagespeed_proxy:3ja82ad9@localhost:8080 -D - -o /dev/null https://www.slate.com  * Connected to localhost (::1) port 8080 (#0) * Establish HTTP proxy tunnel to www.slate.com:443 * Proxy auth using Basic with user 'pagespeed_proxy' > CONNECT www.slate.com:443 HTTP/1.1 > Host: www.slate.com:443  < HTTP/1.0 200 Connection Established HTTP/1.0 200 Connection Established < Proxy-agent: Apache/2.4.25 (Debian) Proxy-agent: Apache/2.4.25 (Debian) <   * Proxy replied OK to CONNECT request * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 * Server certificate: ssl004.insnw.net * Server certificate: GlobalSign CloudSSL CA - SHA256 - G3 * Server certificate: GlobalSign Root CA > GET / HTTP/1.1 > Host: www.slate.com > User-Agent: curl/7.54.0 > Accept: */* >   < Content-Length: 187044 Content-Length: 187044 < Connection: keep-alive Connection: keep-alive < Server: Apache/2.2.29 (Amazon) Server: Apache/2.2.29 (Amazon) < X-Instart-Request-ID: 762420041708891440:FWP01-NPPRY21:1509387251:0 X-Instart-Request-ID: 762420041708891440:FWP01-NPPRY21:1509387251:0 

I've found a lot of posts that say this is possible (and, technically, it should be) with various httpd.conf suggestions, but nothing I've tried has worked. Right now my httpd.conf looks like:

<VirtualHost *:8080>   ProxyRequests On   ProxyVia On    Header set X-MSCProxy SansPS    #SSLEngine On   # suggestion that this allows termination   ProxyPreserveHost On    SSLProxyEngine on   SSLProxyCheckPeerCN Off   SSLProxyCheckPeerExpire Off   SSLProxyCheckPeerName Off    SSLCertificateFile /etc/apache2/ssl/localhost.crt   SSLCertificateKeyFile /etc/apache2/ssl/localhost.key    ModPagespeed Off </VirtualHost> 

FWIW, when I enable SSLEngine on this proxy (as has been suggested) then the request simply doesn't work with this error from Apache:

[Mon Oct 30 18:20:20.705047 2017] [ssl:info] [pid 372:tid 140147985901312] [client 172.17.0.1:34012] AH01996: SSL handshake failed: HTTP spoken on HTTPS port; trying to send HTML error page [Mon Oct 30 18:20:20.705107 2017] [ssl:info] [pid 372:tid 140147985901312] SSL Library Error: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request -- speaking HTTP to HTTPS port!? 

Which I guess makes sense as the proxy protocol isn't expecting an HTTPS connection directly to the proxy.

1 Answers

Answers 1

I would try to use the output filter feautre fom apache.

https://www.modpagespeed.com/doc/configuration#apache_specific

AddOutputFilterByType MOD_PAGESPEED_OUTPUT_FILTER text/html

Read More

Proxy test not working in Jasmine

Code

var cartModule = (function() {   var cart = [];   var cart_proxy = new Proxy(cart, {     set: function(target, property, value) {       ...        target[property] = value       return true     }   }    return {     toggleItem: function() {       if (value) {         cart_proxy.push(new Item(item_name));        }     }     getItems: function() {       return cart.map( object => object.name );      }   } }) 

Spec

describe("when toggleitem is called", function() {   beforeEach(function() {     cartModule.toggleItem("ladder", true)   })   it ('adds item', function() {     expect(cartModule.getItems()).toEqual(["ladder"]);   }) }) 

Spec fails if the code says cart_proxy.push, but if code says cart.push spec passes. As well in console, I can confirm that cart_proxy.push is working appropriately. Looks like what's failing is something about the use of the Proxy

2 Answers

Answers 1

For me it seems that, you cannot make cart_proxy properly, and that's the main reason of your test failure. Also, your test may suffers from few issues.

You have syntax error. The correct one is below:

var cartModule = (function() {   var cart = [];   var cart_proxy = new Proxy(cart, {     set: function(target, property, value) {        target[property] = value       return true     }   })    return {     toggleItem: function() {       if (value) {         cart_proxy.push(new Item(item_name));        }     },     getItems: function() {       return cart.map( object => object.name );      }   } }) 

it means that, you forgot to close the parenthesis in the line new Proxy(, and secondly, you lost a , in the return object. Your test works, with cart.push, because your cart is an array and you can inject one more element into it, but because of the stated problem cart_proxy cannot be constructed.

Also, i have some concerns about your beforeEach:

 beforeEach(function() {     cartModule.toggleItem("ladder", true)   }) 

I think the toggleItem is a function in the cartModule which does not receive any parameter, but here it has received 2 arguments.

In conclusion, I suggest you to clean your code.

Answers 2

I think you also need to write get handler for cart_proxy for getItems to work.

Read More

Intercepting proxy's certificates generated on-the-fly provoke browser errors

I've written an intercepting proxy in Python 3 which uses a man-in-the-middle "attack" technique to be able to inspect and modify pages coming through it on the fly. Part of the process of "installing" or setting up the proxy involves generating a "root" certificate which is to be installed in the browser and every time a new domain is hit via HTTPS through the proxy, the proxy generates a new site certificate on-the-fly (and caches all certificates generated to disk so it doesn't have to re-generate certificates for domains for which certificates have already been generated) signed by the root certificate and uses the site certificate to communicate with the browser. (And, of course, the proxy forges its own HTTPS connection to the remote server. The proxy also checks the validity of the server certificate if you're curious.)

Well, it works great with the browser surf. (And, this might be relevant -- as of a few versions back, at least, surf didn't check/enforce certificate validity. I can't attest to whether that's the case for more recent versions.) But, Firefox gives a SEC_ERROR_REUSED_ISSUER_AND_SERIAL error on the second (and all later) HTTPS request(s) made through the proxy and Chromium (I haven't tested with Chrome proper) gives NET::ERR_CERT_COMMON_NAME_INVALID on every HTTPS request. These obviously present a major problem when trying to browse through my intercepting proxy.

The SSL library I'm using is pyOpenSSL 0.14 if that makes any difference.

Regarding Firefox's SEC_ERROR_REUSED_ISSUER_AND_SERIAL error, I'm pretty sure I'm not reusing serial numbers. (If anybody wants to check my work, that would be pretty rad: cert.py - note the "crt.set_serial_number(getrandbits(20 * 8))" on line 168.) The root certificate issuer of course doesn't change, but that wouldn't be expected to change, right? I'm not sure what exactly is meant by "issuer" in the error message if not the root certificate issuer.

Also, Firefox's "view certificate" dialog displays completely different serial numbers for different certificates generated by the proxy. (As an example, I've got one generated for www.google.com with a serial number of 00:BF:7D:34:35:15:83:3A:6E:9B:59:49:A8:CC:88:01:BA:BE:23:A7:AD and another generated for www.reddit.com with a serial number of 78:51:04:48:4B:BC:E3:96:47:AC:DA:D4:50:EF:2B:21:88:99:AC:8C .) So, I'm not really sure what Firefox is complaining about exactly.

My proxy reuses the private key (and thus public key/modulus) for all certificates it creates on the fly. I came to suspect this was what Firefox was balking about and tried changing the code to generate a new key pair for every certificate the proxy creates on the fly. That didn't solve the problem in Firefox. I still get the same error message. I have yet to test whether it solves the Chromium issue.

Regarding Chromium's NET::ERR_CERT_COMMON_NAME_INVALID error, the common name for site certificate is just supposed to be the domain, right? I shouldn't be including a port number or anything, right? (Again, if anybody would like to check my work, see cert.py .) If it helps any, my intercepting proxy isn't using any wildcards in the certificate common names or anything. Every certificate generated is for one specific fqdn.

I'm quite certain making this work without making Firefox or Chrome (or Chromium or IE etc) balk is possible. A company I used to work for purchased and set up a man-in-them-middling proxy through which all traffic from within the corporate network to the internet had to pass. The PC administrators at said company installed a self-signed certificate as a certificate authority in every browser on every company-owned computer used by the employees and the result never produced any errors like the ones Firefox and Chromium have been giving me for the certificates my own intercepting proxy software produces. It's possible the PC administrators tweaked some about:config settings in Firefox to make this all work or something, but I kindof doubt it.

To be fair, the proxy used at this company was either network or transport layer, not application layer like mine. But I'd expect the same can be accomplished in an application-layer HTTP(s) proxy.

Edit: I've tried setting the subjectAltName as suggested by brain99. Following is the line I added in the location brain99 suggested:

r.add_extensions([crypto.X509Extension(b"subjectAltName", False, b"DNS:" + cn.encode("UTF-8"))])

I'm still getting SEC_ERROR_REUSED_ISSUER_AND_SERIAL from Firefox (on the second and subsequent HTTPS requests and I'm getting ERR_SSL_SERVER_CERT_BAD_FORMAT from Chromium.

Here are a couple of certificates generated by the proxy:

google.com: https://pastebin.com/YNr4zfZu

stackoverflow.com: https://pastebin.com/veT8sXZ4

1 Answers

Answers 1

I noticed you only set the CN in your X509Req. Both Chrome and Firefox require the subjectAltName extension to be present; see for example this Chrome help page or this Mozilla wiki page discussing CA required or recommended practices. To quote from the Mozilla wiki:

Some CAs mistakenly believe that one primary DNS name should go into the Subject Common Name and all the others into the SAN.

According to the CA/Browser Forum Baseline Requirements:

• BR #9.2.1 (section 7.1.4.2.1 in BR version 1.3), Subject Alternative Name Extension
  • Required/Optional: Required
  • Contents: This extension MUST contain at least one entry. Each entry MUST be either a dNSName containing the Fully-Qualified Domain Name or an iPAddress containing the IP address of a server.

You should be able to do this easily with pyOpenSSL:

if not os.path.exists(path):     r = crypto.X509Req()     r.get_subject().CN = cn     r.add_extensions([crypto.X509Extension("subjectAltName", False, "DNS:" + cn])     r.set_pubkey(key)     r.sign(key, "sha1") 

If this does not solve the issue, or if it only partially solves it, please post one or two example certificates that exhibit the problem.

---

Aside from this, I also noticed you sign using SHA1. Note that certificates signed with SHA1 have been deprecated in several major browsers, so I would suggest switching to SHA-256.

r.sign(key, "sha256") 

Read More

How can I get spring security to work behind a load balancer across multiple domains?

We are moving an old java / spring app into AWS, so it is behind an AWS Application Load Balancer. Tomcat is running directly behind the load balancers on port 8080, and we are using HTTP between the load balancer and tomcat.

The problem is under this scenario the spring security module doesn't recognize that the connection is secure.

I can resolve this issue by configuring the Connection:

<Connector port="8080"            protocol="HTTP/1.1"            connectionTimeout="20000"            proxyName="single-host.example.com"            secure="true"            scheme="https"            redirectPort="443"            proxyPort="443" /> 

Which works for a single host name. However, I need this to work across multiple host names.

I have tried skipping the proxy and adding:

server.tomcat.remote_ip_header=X-Forwarded-For server.tomcat.protocol_header=X-Forwarded-Proto 

But this doesn't seem to make any difference.

Is there a way to support multiple hostnames in this scenario?

4 Answers

Answers 1

AWS LoadBalancer sends X-Forwarded-Proto header when proxying request.

On Tomcat configure RemoteIpValve to have request.secure and other request variable interpreted from those headers.

<Valve className="org.apache.catalina.valves.RemoteIpValve"/> 

You should also omit setting proxyName on Connector conifiguration since it should come automatically from valve.

Answers 2

I am got some solution procedure. So I have provided 2 suggestion. First one is step by step pictorial view to solve your issue. If not, then go to the second one.

Second one is using X-Forwarded-Proto and related configuration to solve the issue. Hope it will help you.

Suggestion#1:

Amazon cloud environment with load balance support process is pretty straight-forward. A step by step tutorial is given here:Elastic Load Balancing (ELB) with a Java Web Application + Tomcat + Session Stickiness

Suggestion#2:

phillipuniverse has given a solution.

Configuring the following valve in Tomcat will make request.isSecure() function properly with the X-Forwarded-Proto header:

<Valve className="org.apache.catalina.valves.RemoteIpValve" protocolHeader="X-Forwarded-Proto" />

This can be added to Tomcat's server.xml under the <Host> element.

---

And of course, after all that, there is a very, VERY simple solution that fixes this problem from the very beginning. All that really needed to happen was to modify the proto channel filters from this:

if ("https".equals(invocation.getHttpRequest().getHeader("X-Forwarded-Proto"))) {     getEntryPoint().commence(invocation.getRequest(), invocation.getResponse()); } 

to:

if (invocation.getHttpRequest().isSecure() ||          "https".equals(invocation.getHttpRequest().getHeader("X-Forwarded-Proto"))) {     getEntryPoint().commence(invocation.getRequest(), invocation.getResponse()); } 

The final configuration here should be this:

<bean class="org.broadleafcommerce.common.security.channel.ProtoChannelBeanPostProcessor">     <property name="channelProcessorOverrides">       <list>         <bean class="org.broadleafcommerce.common.security.channel.ProtoInsecureChannelProcessor" />         <bean class="org.broadleafcommerce.common.security.channel.ProtoSecureChannelProcessor" />       </list>     </property> </bean> 

---

After that,

Some prefer to terminate SSL at the load balancer, and to not use Apache web server. In that case, you often accept traffic at the LB on 80 / 443, and then route traffic to Tomcat on 8080.

If you are using Spring's port mapping:

<sec:port-mappings>     <sec:port-mapping http="8080" https="443"/> </sec:port-mappings> 

This will not work as it does not override the port mapping in the new Channel Processors. Here is a configuration that will work, though:

<bean class="org.broadleafcommerce.common.security.channel.ProtoChannelBeanPostProcessor">     <property name="channelProcessorOverrides">         <list>             <bean class="org.broadleafcommerce.common.security.channel.ProtoInsecureChannelProcessor" >                 <property name="entryPoint">                     <bean class="org.springframework.security.web.access.channel.RetryWithHttpEntryPoint">                         <property name="portMapper" ref="portMapper"/>                     </bean>                 </property>             </bean>             <bean class="org.broadleafcommerce.common.security.channel.ProtoSecureChannelProcessor" >                 <property name="entryPoint">                     <bean class="org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint">                         <property name="portMapper" ref="portMapper"/>                     </bean>                 </property>             </bean>         </list>     </property> </bean> 

Resource Link: HTTPS/SSL/Spring Security doesn't work in both a load balancer and non-load balancer environment #424

Answers 3

You should setup HTTPS connection on the LB, then you'll have a proper TLS connection between the LB and the tomcat so spring will stop crying. You'll just have to provide a self-signed certificate to the LB and setup your spring security module with the private key that have generated this self signed certificate.

(a more complex option: setup properly the tomcat proxy, to force it to encapsulate the HTTP stream of the LB in an HTTPS stream. Setup all TLS requirements in the proxy: certificate, private key...)

Answers 4

Did you try to put LB address as proxyName? It might work on your case.

Read More

Don't execute jenkins job if svn polling failed

I have a jenkins job, that is polling svn every 5 minutes and executing my unittests if some changes occured.

My probleme is, the svn polling fails randomly due to a unreachable proxy.

org.tmatesoft.svn.core.SVNAuthenticationException: svn: E170001: HTTP proxy authorization failed 

I guess this problem is related to some issues with the proxy we use and not the configuration of my job or machine.

My question now is, can I skip the job if the svn poll is failing and only execute if it was succesful? So that I don't have failed builds in my job list because of the proxy issue.

Or does anyhow have an idea why this random error can occure?

Fyi, I don't want the proxy problem itself fixed, as this is probably happening due to network problems, but I just want to skip the execution of the job if the svn poll fails.

2 Answers

Answers 1

Instead of polling svn, you can try a post-commit hook so that svn notifies Jenkins of changes; see https://wiki.jenkins-ci.org/display/JENKINS/Subversion+Plugin?focusedCommentId=43352266

Answers 2

In order to prevent running next action when the previous action is failed, add set +e to the top of your shell script. -e option is exit immediately when any action returns 1(which means failed). And also. @mikep's answer is useful thought. Instead of polling, Post-commit hook is more efficient.

Read More

A Python script, a proxy and Microsoft Forefront - Auto-Authentication

Today I'm dealing with a Python3 script that has to do a http post request and send a mail.

The Python script is launched on a Windows PC that is in a corporate network protected by Forefront. The user is logged with his secret credentials and can access to the internet through a proxy.

Like the other non-Microsoft applications (i.e. Chrome), I want my script to connect to the internet without prompt the user for his username and password.

How can I do this?

1 Answers

Answers 1

On Microsoft OSes, the authentication used is Kerberos, so you won't be able to use directly your ID + password.

I'm on Linux, so I can't test it directly but I think that you can create a proxy with fiddler which can negociate the authentication for you, and you can use this proxy with python.

Fiddler's Composer will automatically respond to authentication challenges (including the Negotiate protocol which wraps Kerberos) if you tick the Authentication box on the Options subtab, in the menus.

Read More

Proxying requests in Node

I need to be able to offer replica sites (to www.google.com, www.facebook.com, etc. any site) through my node server. I found this library:

https://github.com/nodejitsu/node-http-proxy

And I used the following code when proxying requests:

options = {   ignorePath: true,   changeOrigin: false }  var proxy = httpProxy.createProxyServer({options});  router.get(function(req, res) {   proxy.web(req, res, { target: req.body.url }); }); 

However, this configuration causes an error for most sites. Depending on the site, I'll get an Unknown service error coming from the target url, or an Invalid host... something along those lines. However, when I pass

changeOrigin: true 

I get a functioning proxy service, but my the user's browser gets redirected to the actual url of their request, not to mine (so if req.body.url = http://www.google.com, the request will go to http://www.google.com)

How can I make it so my site's url gets shown, but so that I can exactly copy whatever is being displayed? I need to be able to add a few JS files to the request, which I'm doing using another library.

For clarification, here is a summary of the problem:

1. The user requests a resource that has a url property

2. This url is in the form of http://www.example.com

3. My server, running on www.pv.com, need to be able to direct the user to www.pv.com/http://www.example.com

4. The HTTP response returned alongside www.pv.com/http://www.example.com is a full representation of http://www.example.com. I need to be able to add my own Javascript/HTML files in this response as well.

2 Answers

Answers 1

Looking at http://stackoverflow.com/a/32704647/1587329, the only difference is that it uses a different target parameter:

var http = require('http'); var httpProxy = require('http-proxy'); var proxy = httpProxy.createProxyServer({});  http.createServer(function(req, res) {     proxy.web(req, res, { target: 'http://www.google.com' }); }).listen(3000); 

This would explain the Invalid host error: you need to pass a host as the target parameter, not the whole URL. Thus, the following might work:

options = {   ignorePath: true,   changeOrigin: false }  var proxy = httpProxy.createProxyServer({options});  router.get(function(req, res) {   var url = req.body.url;   proxy.web(req, res, { target: url.protocol + '//' + url.host }); }); 

For the URL object, see the NodeJS website.

Answers 2

Use a headless browser to navigate to the website and get the HTML of the website. Then send the HTML as a response for the website requested. One advantage of using a headless browser is that it allows you to get the HTML from sites rendered with JavaScript. Nightmare.js (an API or library for electron.js) is a good choice because it uses Electron.js under the hood. The electron framework is faster than Phantom.js (an alternative). With Nightmare.js you can inject a JavaScript file into the page as shown in the code snippet below. You may need to tweak the code to add other features. Currently, I am only allowed to add two links, so links to other resources are in the code snippet.

• To setup a ubuntu server to run Nightmare.js in headless mode you have to install xvfb (an X server) and the dependencies: https://github.com/segmentio/nightmare/issues/224

---

apt-get update && apt-get install -y xvfb x11-xkb-utils xfonts-100dpi xfonts-75dpi xfonts-scalable xfonts-cyrillic x11-apps clang libdbus-1-dev libgtk2.0-dev libnotify-dev libgnome-keyring-dev libgconf2-dev libasound2-dev libcap-dev libcups2-dev libxtst-dev libxss1 libnss3-dev gcc-multilib g++-multilib 

-

// example: http://hostname.com/http://www.tutorialspoint.com/articles/how-to-configure-and-install-redis-on-ubuntu-linux //X server: http://www.linfo.org/x_server.html  var express = require('express') var Nightmare = require('nightmare')// headless browser var Xvfb = require('xvfb')// run headless browser using X server var vo = require('vo')// run generator function var app = express() var xvfb = new Xvfb()   app.get('/', function (req, res) {   res.end('') })  // start the X server to run nightmare.js headless browser xvfb.start(function (err, xvfbProcess) {   if (!err) {     app.get('/*', function (req, res) {       var run = function * () {         var nightmare = new Nightmare({           show: false,           maxAuthRetries: 10,           waitTimeout: 100000,           electronPath: require('electron'),           ignoreSslErrors: 'true',           sslProtocol: 'tlsv1'         })          var result = yield nightmare.goto(req.url.toString().substring(1))         .wait()         // .inject('js', '/path/to/.js') inject a javascript file to manipulate or inject html         .evaluate(function () {           return document.documentElement.outerHTML         })         .end()         return result       }        // execute generator function       vo(run)(function (err, result) {         if (!err) {           res.end(result)         } else {           console.log(err)           res.status(500).end()         }       })     })   } })  app.listen(8080, '0.0.0.0') 

Read More

Proxy with express.js

To avoid same-domain AJAX issues, I want my node.js web server to forward all requests from URL /api/BLABLA to another server, for example other_domain.com:3000/BLABLA, and return to user the same thing that this remote server returned, transparently.

All other URLs (beside /api/*) are to be served directly, no proxying.

How do I achieve this with node.js + express.js? Can you give a simple code example?

(both the web server and the remote 3000 server are under my control, both running node.js with express.js)

---

So far I found this https://github.com/nodejitsu/node-http-proxy/ , but reading the documentation there didn't make me any wiser. I ended up with

var proxy = new httpProxy.RoutingProxy(); app.all("/api/*", function(req, res) {     console.log("old request url " + req.url)     req.url = '/' + req.url.split('/').slice(2).join('/'); // remove the '/api' part     console.log("new request url " + req.url)     proxy.proxyRequest(req, res, {         host: "other_domain.com",         port: 3000     }); }); 

but nothing is returned to the original web server (or to the end user), so no luck.

9 Answers

Answers 1

You want to use http.request to create a similar request to the remote API and return its response.

Something like this:

var http = require('http');  /* your app config here */  app.post('/api/BLABLA', function(req, res) {    var options = {     // host to forward to     host:   'www.google.com',     // port to forward to     port:   80,     // path to forward to     path:   '/api/BLABLA',     // request method     method: 'POST',     // headers to send     headers: req.headers   };    var creq = http.request(options, function(cres) {      // set encoding     cres.setEncoding('utf8');      // wait for data     cres.on('data', function(chunk){       res.write(chunk);     });      cres.on('close', function(){       // closed, let's end client request as well        res.writeHead(cres.statusCode);       res.end();     });      cres.on('end', function(){       // finished, let's finish client request as well        res.writeHead(cres.statusCode);       res.end();     });    }).on('error', function(e) {     // we got an error, return 500 error to client and log error     console.log(e.message);     res.writeHead(500);     res.end();   });    creq.end();  }); 

Notice: I haven't really tried the above, so it might contain parse errors hopefully this will give you a hint as to how to get it to work.

Answers 2

I did something similar but I used request instead:

var request = require('request'); app.get('/', function(req,res) {   //modify the url in any way you want   var newurl = 'http://google.com/';   request(newurl).pipe(res); }); 

I hope this helps, took me a while to realize that I could do this :)

Answers 3

To extend trigoman's answer (full credits to him) to work with POST (could also make work with PUT etc):

app.use('/api', function(req, res) {   var url = 'YOUR_API_BASE_URL'+ req.url;   var r = null;   if(req.method === 'POST') {      r = request.post({uri: url, json: req.body});   } else {      r = request(url);   }    req.pipe(r).pipe(res); }); 

Answers 4

I found a shorter and very straightforward solution which works seamlessly, and with authentication as well, using express-http-proxy:

var proxy = require('express-http-proxy');  // New hostname+path as specified by question: var apiProxy = proxy('other_domain.com:3000/BLABLA', {     forwardPath: function (req, res) {         return require('url').parse(req.baseUrl).path;     } }); 

And then simply:

app.use("/api/*", apiProxy); 

I know I'm late to join this party, but I hope this helps someone.

Answers 5

I used the following setup to direct everything on /rest to my backend server (on port 8080), and all other requests to the frontend server (a webpack server on port 3001). It supports all HTTP-methods, doesn't lose any request meta-info and supports websockets (which I need for hot reloading)

var express  = require('express'); var app      = express(); var httpProxy = require('http-proxy'); var apiProxy = httpProxy.createProxyServer(); var backend = 'http://localhost:8080',     frontend = 'http://localhost:3001';  app.all("/rest/*", function(req, res) {   apiProxy.web(req, res, {target: backend}); });  app.all("/*", function(req, res) {     apiProxy.web(req, res, {target: frontend}); });  var server = require('http').createServer(app); server.on('upgrade', function (req, socket, head) {   apiProxy.ws(req, socket, head, {target: frontend}); }); server.listen(3000); 

Answers 6

Ok, here's a ready-to-copy-paste answer using the require('request') npm module and an environment variable *instead of an hardcoded proxy):

coffeescript

app.use (req, res, next) ->                                                    r = false   method = req.method.toLowerCase().replace(/delete/, 'del')   switch method     when 'get', 'post', 'del', 'put'       r = request[method](         uri: process.env.PROXY_URL + req.url         json: req.body)     else       return res.send('invalid method')   req.pipe(r).pipe res 

javascript:

app.use(function(req, res, next) {   var method, r;   method = req.method.toLowerCase().replace(/delete/,"del");   switch (method) {     case "get":     case "post":     case "del":     case "put":       r = request[method]({         uri: process.env.PROXY_URL + req.url,         json: req.body       });       break;     default:       return res.send("invalid method");   }   return req.pipe(r).pipe(res); }); 

Answers 7

I've created a extremely simple module that does exactly this: https://github.com/koppelaar/auth-proxy

Answers 8

First install express and http-proxy-middleware

npm install express http-proxy-middleware --save 

Then in your server.js

const express = require('express'); const proxy = require('http-proxy-middleware');  const app = express(); app.use(express.static('client'));  // Add middleware for http proxying  const apiProxy = proxy('/api', { target: 'http://localhost:8080' }); app.use('/api', apiProxy);  // Render your site const renderIndex = (req, res) => {   res.sendFile(path.resolve(__dirname, 'client/index.html')); } app.get('/*', renderIndex);  app.listen(3000, () => {   console.log('Listening on: http://localhost:3000'); }); 

In this example we serve the site on port 3000, but when a request end with /api we redirect it to localhost:8080.

http://localhost:3000/api/login redirect to http://localhost:8080/api/login

Answers 9

I found a shorter solution that does exactly what I want https://github.com/nodejitsu/node-http-proxy/

After installing http-proxy

npm install http-proxy --save 

Use it like below in your server/index/app.js

var proxyServer = require('http-route-proxy'); app.use('/api/BLABLA/', proxyServer.connect({   to: 'other_domain.com:3000/BLABLA',   https: true,   route: ['/'] })); 

I really have spent days looking everywhere to avoid this issue, tried plenty of solutions and none of them worked but this one.

Hope it is going to help someone else too :)

Read More

Jetty WebSocket proxying

Just wonder if anyone has experimented with WebSocket proxying (for transparent proxy) using embedded Jetty?

After about a day and a half playing with Jetty 9.1.2.v20140210, all I can tell is that it can't proxy WebSockets in its current form, and adding such support is non-trivial task (afaict at least).

Basically, Jetty ProxyServlet strips out the "Upgrade" and "Connection" header fields regardless of whether it's from a WebSocket handshake request. Adding these fields back is easy as shown below. But, when the proxied server returned a response with HTTP code 101 (switching protocols), no protocol upgrade is done on the proxy server. So, when the first WebSocket packet arrives, the HttpParser chokes and see that as a bad HTTP request.

If anyone already has a solution for it or is familiar with Jetty to suggest what to try, that would be very much appreciated.

Below is the code in my experiment stripping out the unimportant bits:

public class ProxyServer {     public static void main(String[] args) throws Exception     {         Server server = new Server();         ServerConnector connector = new ServerConnector(server);         connector.setPort(8888);         server.addConnector(connector);          // Setup proxy handler to handle CONNECT methods         ConnectHandler proxy = new ConnectHandler();         server.setHandler(proxy);          // Setup proxy servlet         ServletContextHandler context = new ServletContextHandler(proxy, "/", ServletContextHandler.SESSIONS);         ServletHolder proxyServlet = new ServletHolder(MyProxyServlet.class);         context.addServlet(proxyServlet, "/*");          server.start();     } }  @SuppressWarnings("serial") public class MyProxyServlet extends ProxyServlet {     @Override     protected void customizeProxyRequest(Request proxyRequest, HttpServletRequest request)     {         // Pass through the upgrade and connection header fields for websocket handshake request.          String upgradeValue = request.getHeader("Upgrade");         if (upgradeValue != null && upgradeValue.compareToIgnoreCase("websocket") == 0)         {             setHeader(proxyRequest, "Upgrade", upgradeValue);             setHeader(proxyRequest, "Connection", request.getHeader("Connection"));         }     }      @Override     protected void onResponseHeaders(HttpServletRequest request, HttpServletResponse response, Response proxyResponse)     {         super.onResponseHeaders(request, response, proxyResponse);          // Restore the upgrade and connection header fields for websocket handshake request.         HttpFields fields = proxyResponse.getHeaders();         for (HttpField field : fields)         {             if (field.getName().compareToIgnoreCase("Upgrade") == 0)             {                 String upgradeValue = field.getValue();                 if (upgradeValue != null && upgradeValue.compareToIgnoreCase("websocket") == 0)                 {                     response.setHeader(field.getName(), upgradeValue);                     for (HttpField searchField : fields)                     {                         if (searchField.getName().compareToIgnoreCase("Connection") == 0) {                             response.setHeader(searchField.getName(), searchField.getValue());                         }                     }                 }             }         }     } } 

0 Answers

Read More

C# Visual Studio 2015: IWebProxy certificate validation

I'm trying to create a C# proxy DLL that allow VS2015 Community, on my offline workstation, access to internet through a corporate HTTP proxy with authentication.

Following instruction of this MSDN blog post I'm able to connect VisualStudio to HTTP pages in this way:

namespace VSProxy {     public class AuthProxyModule : IWebProxy     {            ICredentials crendential = new NetworkCredential("user", "password");          public ICredentials Credentials         {             get             {                 return crendential;             }             set             {                 crendential = value;             }         }          public Uri GetProxy(Uri destination)         {             ServicePointManager.ServerCertificateValidationCallback = (Header, Cer, Claim, SslPolicyErrors) => true;             return new Uri("http://128.16.0.123:1234", UriKind.Absolute);         }          public bool IsBypassed(Uri host)         {             return host.IsLoopback;         }     } } 

But I'm not able to connect to the account authentication page for Visual Studio Community access.

So, I'm trying to validate Microsoft certificate using DLL.

There is any way can I accomplish HTTPS and certificate issue?

How can I validate the certificate in the webProxy DLL?

0 Answers

Read More

400 bad request on nginx proxy to tomcat but not on static content

We have been running into an issue when our cookies reach a certain size (over 7k) where nginx is returning 400 Bad Request with an empty response when proxying to our tomcat. This doesn't happen when nginx is serving the static content however. We have already tried updating the nginx config to increase the buffer size so it should handle individual headers up to 16k (we've also tried to set it on server level):

http {   # ...   client_body_buffer_size     32k;   client_header_buffer_size 16k;   large_client_header_buffers 4 16k;   # ... } 

We have also upped the tomcat max-http-header-size to 16k. If we increase the cookie size to over 16k we still get a 400 bad request but the response has the "Request Header Or Cookie Too Large" error message. Something strange is happening between 8k and 16k header sizes that we can't figure out.

1 Answers

Answers 1

This does not appear to be an nginx issue, as it's unlikely for it to be returning empty pages, which are usually the classic tomcat signature.

It would appear that setting up the header size may depend on the connector that you're using:

• Setting Max HTTP Header Size With AJP / Tomcat 6.0

Read More

Maven nonProxyHosts are not used

I've got a problem deploying to our companys nexus using a proxy.

• Our Nexus is hosted on http://nexus.my.company.de:8081/
• My Jenkins is hosted on http://myjenkins.my.company.de:8080/

To access the internet I need a proxy. Due to security reasons the proxy has no connection from the proxy to internal network, meaning as soon as there is a call (from my jenkins or any other server) to the proxy this call can't get a connection back to internal network only to the "real/outside" internet.

Therefor I defined several <nonProxyHosts> in the maven settings.xml used by the jenkins.

<proxy>   <id>optional</id>   <active>true</active>   <protocol>http</protocol>   <host>inet.my.company.de</host>         <port>5555</port> <!-- switched to 5555 for StackOverflow -->   <nonProxyHosts>localhost|127.0.0.1|<ip-of-the-nexus>|*.my.company.de</nonProxyHosts> </proxy> 

But everytime I run a build, which should deploy to nexus I get an

Access denied to: http://nexus.my.company.de:8081/<....> , ReasonPhrase: Forbidden.

I already talked to our network administrators and when monitoring the network traffic we always see that the proxy is called. So we run several tests together, always watching if the proxy is called or not:

• When I change the port of the proxy it fails completly as the proxy port is wrong and the calls are blocked correctly
• Trying several <nonProxyHosts> entries, with *, with IP, with full hostname, with hostename and port (nexus.my.company.de:8080) result in calls to the proxy that are not routed back to internal network as intended
• Chaning <distributionManagement> inside the project from hostname to IP based and setting correspondending <nonProxyHosts> entries also result in calls to the proxy that are not routed back to internal network as intended
• When deactivating the proxy (setting <active>false</active>) the proxy is not called and the deployment works smoothly. This also shows that firewall settings and access rights are correct.

Our conclusion is that the <nonProxyHosts> entries are not used / regognized. So my question is how can I define hosts for which maven does not use the proxy definied in settings.xml but calls them directly?

1 Answers

Answers 1

Nexus ip/hostname should be in <nonProxyHosts>.

You can also pass value over command line:

mvn clean build -Djava.net.useSystemProxies=false -Dhttp.proxyHost=inet.my.company.de -Dhttp.proxyPort=5555 –Dhttp.nonProxyHosts= localhost|127.*| <ip-of-the-nexus>|*.my.company.de

Please can you check do you get anything related to 403 error in the nexus log. If you get this message on nexus side please check this first:

Code 403 - Forbidden

The login credentials sent were valid, but the user does not have permission to upload to the repository. Go to "administration/security" in the Nexus UI, and bring up the user (or the user's role if they are mapped via an external role mapping) and examine the role tree to see what repository privileges they have been assigned. A user will need create and update privileges for a repository to be able to deploy into it.

Read More

Node Proxy - Proxy a SSL localhost target from a basic http server

What I am trying to do:

Proxy a java api that runs on https://127.0.0.1:443/api/ along side my UI that runs on non-SSL http://127.0.0.1:1337/ in order to circumnavigate some CORS issues.

My attempt:

1. Proxy the api at the SSL port 443 to my non-SSL development port of 1338.
2. proxy my UI to 1337
3. Proxy 1137 to :8080/index.html and proxy 1338 to :8080/api/
4. Access my app from localhost:8080

My problem:

The UI comes in just fine... but I can not hit the API at :8080/api/httpSession/init

Yes, I can still hit the API at https://localhost/api/httpSession/init

api.js - Renders index.html at :1337

var app = express();  app.all('*', function (req, res, next) {   res.header('Access-Control-Allow-Origin', '*');   res.header('Access-Control-Allow-Methods', 'PUT, GET, POST, DELETE, OPTIONS');   res.header('Access-Control-Allow-Headers', 'Content-Type');   next(); });  var options = {   changeOrigin: true,   target: {       https: true   } };  httpProxy.createServer(443, '127.0.0.1', options).listen(1338); 

start.js - Proxies 1337 and 1338 into 8080

// First I start my two servers uiServer.start(); // renders index.html at 1337 apiServer.start(); //   // I attempt to patch them back into one single non-SSL port. app   .use('/', proxy({target: 'http://localhost:1337/'}))   .all('/api/*', proxy({target: 'http://localhost:1338/'}))   .listen(8080, function () {     console.log('PROXY SERVER listening at http://localhost:%s', 8080);   }); 

2 Answers

Answers 1

For the proxy issue, my guess is that it is keeping the /api/* in the url and that's not present on the router in your API service. You could try adding /api to the router in the API service since it's going to keep the url string the same when it sends it. Otherwise, you likely need to proxy and rewrite the url so that the API will match the request to a route.

On another note, what about just installing the cors module and using in the app? I do something similar and it's working well without all the proxy items. https://www.npmjs.com/package/cors

Answers 2

What you're looking for is request piping. Try this example:

  // Make sure request is in your package.json   //   if not, npm install --save request   var request = require('request');    // Intercept all routes to /api/...   app.all('/api/*', function (req, res) {     // Get the original url, it's a fully qualified path     var apiPath = req.originalUrl;      // Form the proxied URL to your java API     var url = 'https://127.0.0.1' + apiPath;      // Fire off the request, and pipe the response     // to the res handler     request.get(url).pipe(res);   }); 

Make sure to add some error handling if the api can't be reached, such as this SO solution.

Read More

Proxy web socket in shiny server using Apache 2.4

I am using the shiny-server (latest version, 1.4.2.786) behind the Apache 2.4, Ubuntu 14.04.

Following the instruction of online documentation (https://support.rstudio.com/hc/en-us/articles/213733868-Running-Shiny-Server-with-a-Proxy), I can setup the proxy correctly for web sockets. However, I would like to point my URL directly a shiny app (not all apps).

This is my current configuration:

ProxyPreserveHost On ProxyPassMatch "^/(.+)/websocket" "ws://localhost:3838/$1/websocket" ProxyPass "/" "http://localhost:3838/users/username/appname/" ProxyPassReverse "/" "http://localhost:3838/users/username/appname/" ProxyRequests Off 

With this configuration, I still get an error message:

WebSocket connection to  'wss://my-url/__sockjs__/ n=WxwgyafTMc2bWeH5eR/787/mx9zqt68/websocket'  failed: Error during WebSocket handshake:  Unexpected response code: 500 

I guess this is caused by the configuration of proxy of socket. Thanks for any suggestions to fix it.

1 Answers

Answers 1

Have you seen this? It says that your code should look like:

ProxyPreserveHost On ProxyPassMatch "^/(.+)/websocket" "ws://localhost:3838/$1/websocket" ProxyPass "/users/username/appname/" "http://localhost:3838/users/username/appname/" ProxyPassReverse "/users/username/appname/" "http://localhost:3838/users/username/appname/" ProxyRequests Off 

Hope that helps!

Read More