The directive JkOptions allow you to set many forwarding options which will enable (+)
or disable (-) following option. Without any leading signs, options will be enabled.
The four following options +ForwardURIxxx are mutually exclusive.
Exactly one of them is required, a negative sign prefix is not allowed with them.
The default value is "ForwardURIProxy" since version 1.2.24.
It was "ForwardURICompatUnparsed" in version 1.2.23 and
"ForwardURICompat" until version 1.2.22.
You can turn the default off by switching on one of the other two options.
You should leave this at it's default value, unless you have a very good
reason to change it.
All options are inherited from the global server to virtual hosts.
Options that support enabling (plus options) and disabling (minus options),
are inherited in the following way:
options(vhost) = plus_options(global) - minus_options(global) + plus_options(vhost) - minus_options(vhost)
Using JkOptions ForwardURIProxy, the forwarded URI
will be partially reencoded after processing inside Apache and
before forwarding to Tomcat. This will be compatible with local
URL manipulation by mod_rewrite and with URL encoded session ids.
JkOptions +ForwardURIProxy
Using JkOptions ForwardURICompatUnparsed, the forwarded URI
will be unparsed. It's spec compliant and secure.
It will always forward the original request URI, so rewriting
URIs with mod_rewrite and then forwarding the rewritten URI
will not work.
JkOptions +ForwardURICompatUnparsed
Using JkOptions ForwardURICompat, the forwarded URI will
be decoded by Apache. Encoded characters will be decoded and
explicit path components like ".." will already be resolved.
This is less spec compliant and is not safe if you are using
prefix JkMount. This option will allow to rewrite URIs with
mod_rewrite before forwarding.
JkOptions +ForwardURICompat
Using JkOptions ForwardURIEscaped, the forwarded URI will
be the encoded form of the URI used by ForwardURICompat.
Explicit path components like ".." will already be resolved.
This will not work in combination with URL encoded session IDs,
but it will allow to rewrite URIs with mod_rewrite before forwarding.
JkOptions +ForwardURIEscaped
JkOptions RejectUnsafeURI will block all
URLs, which contain percent signs '%' or backslashes '\'
after decoding.
Most web apps do not use such URLs. Using the option RejectUnsafeURI, you
can block several well known URL encoding attacks. By default, this option
is not set.
You can also realise such a check with mod_rewrite, which is more powerful
but also slightly more complicated.
JkOptions +RejectUnsafeURI
JkOptions CollapseSlashesAll is deprecated as of 1.2.44 and will be
ignored if used.
JkOptions CollapseSlashesUnmount is deprecated as of 1.2.44 and will be
ignored if used.
JkOptions CollapseSlashesNone is deprecated as of 1.2.44 and will be
ignored if used.
JkOptions ForwardDirectories is used in conjunction with DirectoryIndex
directive of Apache. As such mod_dir should be available to Apache,
statically or dynamically (DSO)
When DirectoryIndex is configured, Apache will create sub-requests for
each of the local-url's specified in the directive, to determine if there is a
local file that matches (this is done by stat-ing the file).
If ForwardDirectories is set to false (default) and Apache doesn't find any
files that match, Apache will serve the content of the directory (if directive
Options specifies Indexes for that directory) or a 403 Forbidden response (if
directive Options doesn't specify Indexes for that directory).
If ForwardDirectories is set to true and Apache doesn't find any files that
match, the request will be forwarded to Tomcat for resolution. This is used in
cases when Apache cannot see the index files on the file system for various
reasons: Tomcat is running on a different machine, the JSP file has been
precompiled etc.
Note that locally visible files will take precedence over the
ones visible only to Tomcat (i.e. if Apache can see the file, that's the one
that's going to get served). This is important if there is more then one type of
file that Tomcat normally serves - for instance Velocity pages and JSP pages.
JkOptions +ForwardDirectories
Setting JkOptions ForwardLocalAddress, you ask mod_jk to send the local address
of the Apache HTTP Server instead of remote client address. This can be used by
Tomcat remote address valve for allowing connections only from configured Apache
servers.
JkOptions +ForwardLocalAddress
Setting JkOptions ForwardPhysicalAddress, you ask mod_jk to send the
physical peer TCP IP address as the client address. By default mod_jk
uses the logical address as provided by the web server. For example the module
mod_remoteip sets the logical IP address to the client IP forwarded by proxies
in the X-Forwarded-For header.
JkOptions +ForwardPhysicalAddress
JkOptions FlushPackets, you ask mod_jk to flush Apache's connection
buffer after each AJP packet chunk received from Tomcat. This option can have
a strong performance penalty for Apache and Tomcat as writes are performed
more often than would normally be required (ie: at the end of each
response).
JkOptions FlushHeader, you ask mod_jk to flush Apache's connection
buffer after the response headers have been received from Tomcat.
JkOptions DisableReuse, you ask mod_jk to close connections immediately
after their use. Normally mod_jk uses persistent connections and pools idle
connections to reuse them, when new requests have to be sent to Tomcat.
Using this option will have a strong performance penalty for Apache and Tomcat.
Use this only as a last resort in case of unfixable network problems.
If a firewall between Apache and Tomcat silently kills idle connections,
try to use the worker attribute socket_keepalive in combination with an appropriate
TCP keepalive value in your OS.
JkOptions ForwardKeySize, you ask mod_jk, when using ajp13, to forward also the SSL Key Size as
required by Servlet API 2.3.
This flag shouldn't be set when servlet engine is Tomcat 3.2.x (off by default).
JkOptions +ForwardKeySize
JkOptions ForwardSSLCertChain, you ask mod_jk, when using ajp13,
to forward SSL certificate chain (off by default).
Mod_jk only passes the SSL_CLIENT_CERT to the AJP connector. This is not a
problem with self-signed certificates or certificates directly signed by the
root CA certificate. However, there's a large number of certificates signed by
an intermediate CA certificate, where this is a significant problem: A servlet
will not have the possibility to validate the client certificate on its own. The
bug would be fixed by passing on the SSL_CLIENT_CERT_CHAIN to Tomcat via the AJP connector.
This directive exists only since version 1.2.22.
JkOptions +ForwardSSLCertChain
The directive JkEnvVar allows you to forward environment variables
from Apache server to Tomcat engine.
You can add a default value as a second parameter to the directive.
If the default value is not given explicitly, the variable
will only be send, if it is set during runtime.
The variables can be retrieved on the Tomcat side as request attributes
via request.getAttribute(attributeName).
Note that the variables send via JkEnvVar will not be listed
in request.getAttributeNames().
The variables are inherited from the global server to virtual hosts.
JkEnvVar SSL_CLIENT_V_START undefined
