We have been running for a while with no problems with Nuxeo/http running behind an Apache httpd reverse proxy also running http. We are currently moving the Apache instance to use https instead.
I followed the instructions in various places, eg here: http://doc.nuxeo.com/display/public/ADMINDOC/HTTP+and+HTTPS+Reverse-Proxy+Configuration
(except with "casemanager" substituted for "nuxeo" as the root of the URL. Also the proxy was set up on a non-standard port, 8090)
And added nuxeo-virtual-host when moving to https.
When trying to access <a href="https://REVERSE_PROXY:8090/casemanager/" target="test_blank" rel="nofollow noopener noreferrer">https://REVERSE_PROXY:8090/casemanager/</a>
I would get redirected to
<a href="http://REVERSE_PROXY:8090/casemanager/nxstartup.faces" target="test_blank" rel="nofollow noopener noreferrer">http://REVERSE_PROXY:8090/casemanager/nxstartup.faces</a> (ie http not https)
This happened regardless of whether nuxeo-virtual-host was set
Looking at the tcpdump logs confirmed the headers were all set sensibly, but the redirect was wrong
Get /casemanager/
/>
Host: REVERSE_PROXY:8090
/>
X-Forwarded-Host REVERSE_PROXY:8090
/>
X-Forwarded-Proto: https
/>
nuxeo-virtual-host: <a href="https://REVERSE_PROXY:8090/" target="test_blank" rel="nofollow noopener noreferrer">https://REVERSE_PROXY:8090/</a>
was
HTTP/1.1 302 Moved Temporarily
/>
Server: Apache-Coyote/1.1
/>
Location: <a href="http://REVERSE_PROXY:8090/casemanager/nxstartup.faces" target="test_blank" rel="nofollow noopener noreferrer">http://REVERSE_PROXY:8090/casemanager/nxstartup.faces</a>
I fixed it by adding the following directive to Apache for /casemanager/ URLs:
Header edit Location <a href="http://(.*/casemanager.*)" target="test_blank" rel="nofollow noopener noreferrer">http://(.*/casemanager.*)</a> <a href="https://%241" target="test_blank" rel="nofollow noopener noreferrer">https://$1</a>
This all seems to work (I didn't remove the nuxeo-virtual-app to see if that was still necessary)
But was curious if I could have messed something up (given the above request headers seem correct) - plus to post my solution in case it helps anyone else.
