Reverse Proxy and HTTP Redirects

As a reverse proxy cache, Traffic Server serves requests on behalf of origin servers. Traffic Server is configured in such a way that it appears to clients like a normal origin server.

This chapter discusses the following topics:

• Understanding Reverse Proxy Caching
• HTTP Reverse Proxy
• Redirecting HTTP Requests

Understanding Reverse Proxy Caching

With forward proxy caching, Traffic Server handles web requests to distant origin servers on behalf of the clients requesting the content. Reverse proxy caching (also known as server acceleration or virtual web hosting) is different because Traffic Server acts as a proxy cache on behalf of the origin servers that store the content. Traffic Server is configured to be the origin server that the user is trying to connect to (in contrast to a typical scenario inwhich the advertised hostname of the origin server resolves to Traffic Server, which acts as the real origin server).

Reverse Proxy Solutions

There are many ways to use Traffic Server as a reverse proxy. Below are a few example scenarios.

You can use Traffic Server in reverse proxy mode to:

• Offload heavily-used origin servers
• Deliver content efficiently in geographically distant areas
• Provide security for origin servers that contain sensitive information

Offloading Heavily-Used Origin Servers

Traffic Server can absorb requests to the main origin server and improve the speed & quality of web serving by reducing load and hot spots on backup origin servers. For example, a web hoster can maintain a scalable Traffic Server serving engine with a set of low-cost, low-performance, less-reliable PC origin servers as backup servers. In fact, a single Traffic Server can act as the virtual origin server for multiple backup origin servers, as shown in the figure below.

Traffic Server as reverse proxy for a pair of origin servers

Delivering Content in Geographically-Dispersed Areas

Traffic Server can be used in reverse proxy mode to accelerate origin servers that provide content to areas not located within close geographical proximity. Caches are typically easier to manage and are more cost-effective than replicating data. For example, Traffic Server can be used as a mirror site on the far side of a trans-Atlantic link to serve users without having to fetch the request and content across expensive international connections. Unlike replication, for which hardware must be configured to replicate all data and to handle peak capacity, Traffic Server dynamically adjusts to best utilize the serving and storing capacity of the hardware. Traffic Server is also designed to keep content fresh automatically, thereby eliminating the complexity of updating remote origin servers.

Providing Security for an Origin Server

Traffic Server can be used in reverse proxy mode to provide security for an origin server. If an origin server contains sensitive information that you want to keep secure inside your firewall, then you can use a Traffic Server outside the firewall as a reverse proxy for that origin server. When outside clients try to access the origin server, the requests instead go to Traffic Server. If the desired content is not sensitive, then it can be served from the cache. If the content is sensitive and not cacheable, then Traffic Server obtains the content from the origin server (the firewall allows only Traffic Server access to the origin server). The sensitive content resides on the origin server, safely inside the firewall.

How Does Reverse Proxy Work?

When a browser makes a request, it normally sends that request directly to the origin server. When Traffic Server is in reverse proxy mode, it intercepts the request before it reaches the origin server. Typically, this is done by setting up the DNS entry for the origin server (ie, the origin server’s 'advertised' hostname) so it resolves to the Traffic Server IP address. When Traffic Server is configured as the origin server, the browser connects to Traffic Server rather than the origin server. For additional information, see HTTP Reverse Proxy.

Note: To avoid a DNS conflict, the origin server’s hostname and its advertised hostname must not be the same.

HTTP Reverse Proxy

In reverse proxy mode, Traffic Server serves HTTP requests on behalf of a web server. The figure below illustrates how Traffic Server in reverse proxy mode serves an HTTP request from a client browser.

HTTP reverse proxy

The figure above demonstrates the following steps:

1. A client browser sends an HTTP request addressed to a host called www.host.com on port 80. Traffic Server receives the request because it is acting as the origin server (the origin server’s advertised hostname resolves to Traffic Server).
2. Traffic Server locates a map rule in the remap.config file and remaps the request to the specified origin server (realhost.com).
3. Traffic Server opens an HTTP connection to the origin server.
4. If the request is a cache hit and the content is fresh, then Traffic Server sends the requested object to the client from the cache. Otherwise, Traffic Server obtains the requested object from the origin server, sends the object to the client, and saves a copy in its cache.

To configure HTTP reverse proxy, you must perform the following tasks:

• Create mapping rules in the remap.config file (refer to Creating Mapping Rules for HTTP Requests).
• Enable the reverse proxy option (refer to Enabling HTTP Reverse Proxy).

In addition to the tasks above, you can also Set Optional HTTP Reverse Proxy Options.

Creating Mapping Rules for HTTP Requests

In forward proxy caching, Traffic Server acts as a proxy server and receives proxy requests. In reverse proxy caching, however, Traffic Server must act as an origin server rather than a proxy server - this means that it receives server requests and not proxy requests. Therefore, to satisfy proxy requests, Traffic Server must construct a proxy request from the server request.

In HTTP, proxy requests specify the entire URL whereas server requests specify only the path. A server request might look like this:
GET /index.html HTTP/1.0 Host: real.dianes_books.com

However, the corresponding proxy request would look like this:
GET http://real.dianes_books.com/index.html HTTP/1.0 Host: real.dianes_books.com

Traffic Server can construct a proxy request from a server request by using the server information in the host header. However, the correct proxy request must contain the hostname of the origin server, not the advertised hostname that name servers associate to Traffic Server. The advertised hostname is the name that appears in the host header; for the origin server real.dianes_books.com, the server request and host header would be:
GET /index.html HTTP/1.0 Host: www.dianes_books.com

To translate www.dianes_books.com to real.dianes_books.com, Traffic Server needs a set of URL rewriting rules (mapping rules). Mapping rules are described in Using Mapping Rules for HTTP Requests.

In general, use reverse proxy mode to support more than one origin server. In this case, all of the advertised hostnames resolve to the IP address or virtual IP address of Traffic Server. Using host headers, Traffic Server is able to translate server requests for any number of servers into proxy requests for those servers. If Traffic Server receives requests from older browsers that do not support host headers, then Traffic Server can either route these requests directly to a specific server or send the browser to a URL containing information about the problem (refer to Setting Optional HTTP Reverse Proxy Options).

Handling Origin Server Redirect Responses

Origin servers often send redirect responses back to browsers that redirecting them to different pages. For example, if an origin server is overloaded, then it might redirect browsers to a less loaded server. Origin servers also redirect when web pages have moved to different locations. When Traffic Server is configured as a reverse proxy, it must readdress redirects from origin servers so that browsers are redirected to Traffic Server and not to another origin server.

To readdress redirects, Traffic Server uses reverse-map rules. In general, you should set up a reverse-map rule for each map rule. To create reverse-map rules, refer to Using Mapping Rules for HTTP Requests.

Using Mapping Rules for HTTP Requests

Traffic Server uses two types of mapping rules for HTTP reverse proxy:

• A map rule translates the URL in client requests into the URL where the content is located. When Traffic Server is in reverse proxy mode and receives an HTTP client request, it first constructs a complete request URL from the relative URL and its headers. Traffic Server then looks for a match by comparing the complete request URL with its list of target URLs in the remap.config file. For the request URL to match a target URL, the following conditions must be true:
  • The scheme of both URLs must be the same
  • The host in both URLs must be the same. If the request URL contains an unqualified hostname, then it will never match a target URL with a fully-qualified hostname.
  • The ports in both URLs must be the same. If no port is specified in a URL, then the default port for the scheme of the URL is used.
  • The path portion of the target URL must match a prefix of the request URL path
  If Traffic Server finds a match, then it translates the request URL into the replacement URL listed in the map rule: it sets the host and path of the request URL to match the replacement URL. If the URL contains path prefixes, then Traffic Server removes the prefix of the path that matches the target URL path and substitutes it with the path from the replacement URL. If two mappings match a request URL, then Traffic Server applies the first mapping listed in the remap.config file.


• A reverse-map rule translates the URL in origin server redirect responses to point to Traffic Server so that clients are redirected to Traffic Server instead of accessing an origin server directly. For example, if there is a directory /pub on an origin server at www.molasses.com and a client sends a request to that origin server for /pub, then the origin server might reply with a redirect to http://www.test.com/pub/ to let the client know that it was a directory it had requested, not a document (a common use of redirects is to normalize URLs so that clients can bookmark documents properly).
  Traffic Server uses reverse-map rules to prevent clients (that receive redirects from origin servers) from bypassing Traffic Server and directly accessing the origin servers.

Both map and reverse-map rules consist of a target (origin) URL and a replacement (destination) URL. In a map rule, the target URL points to Traffic Server and the replacement URL specifies where the original content is located. In a reverse-map rule, the target URL specifies where the original content is located and the replacement URL points to Traffic Server. Traffic Server stores mapping rules in the remap.config file located in the Traffic Server config directory.

To create mapping rules:

1. In a text editor, open the remap.config file located in the Traffic Server config directory.
2. Enter your map and reverse-map rules (refer to remap.config).
3. Save and close the remap.config file.
4. Navigate to the Traffic Server bin directory.
5. Run the command traffic_line -x to apply the configuration changes.

Enabling HTTP Reverse Proxy

To enable HTTP reverse proxy, follow the steps below.

1. In a text editor, open the records.config file located in the config directory.
2. Edit the following variable:

Variable	Description
proxy.config.reverse_proxy.enabled	Set this variable to 1 to enable HTTP reverse proxy mode.

3. Save and close the records.config file.
4. Navigate to the Traffic Server bin directory.
5. Run the command traffic_line -x to apply the configuration changes.

Setting Optional HTTP Reverse Proxy Options

Traffic Server provides several reverse proxy configuration options that enable you to:

• Configure Traffic Server to retain the client host header information in a request during translation
• Configure Traffic Server to serve requests only to the origin servers listed in the mapping rules. As a result, requests to origin servers not listed in the mapping rules are not served.
• Specify an alternate URL to which incoming requests from older clients (i.e., ones that do not provide Host headers) are directed

To set optional HTTP reverse proxy options:

1. In a text editor, open the records.config file located in the config directory.
2. Edit the following variables:

Variable	Description
proxy.config.url_remap.pristine_host_hdr	Set this variable to 1 to retain the client host header in the request. Set this variable to 0 (zero) if you want Traffic Server to translate the client host header.
proxy.config.url_remap.remap_required	Set this variable to 1 if you want Traffic Server to serve requests only to the origin servers listed in the mapping rules of the remap.config file. Set this variable to 0 (zero) if you want Traffic Server to serve requests to all origin servers.
proxy.config.header.parse.no_host_url_redirect	Enter the URL to which to redirect requests with no host headers.

3. Save and close the records.config file.
4. Navigate to the Traffic Server bin directory.
5. Run the command traffic_line -x to apply the configuration changes.

Redirecting HTTP Requests

You can configure Traffic Server to redirect HTTP requests without having to contact any origin servers. For example, if you redirect all requests for http://www.ultraseek.com to http://www.server1.com/products/portal/search/, then all HTTP requests for www.ultraseek.com go directly to www.server1.com/products/portal/search.

You can configure Traffic Server to perform permanent or temporary redirects. Permanent redirects notify the browser of the URL change (by returning the HTTP status code 301) so that the browser can update bookmarks. Temporary redirects notify the browser of the URL change for the current request only (by returning the HTTP status code 307).

To set redirect rules:

1. In a text editor, open the remap.config file located in the Traffic Server config directory.
2. Enter a mapping rule for each redirect you want to set. Each mapping rule must be on a separate line and must consist of three space-delimited fields: type, target, and replacement. The following table describes the format for each field.
   

   Field	Description
   type	Enter either one of the following:   redirect—redirects HTTP requests permanently without having to contact the origin server.   redirect_temporary—redirects HTTP requests temporarily without having to contact the origin server.
   target	Enter the origin or from URL. You can enter up to four components:   scheme://host:port/path_prefix
   replacement	Enter the destination or to URL. You can enter up to four components:   scheme://host:port/path_prefix

   The following permanently redirects all HTTP requests for www.server1.com to www.server2.com :
   redirect http://www.server1.com http://www.server2.com
   
   
3. Save and close the remap.config file.
4. Navigate to the Traffic Server bin directory.
5. Run the command traffic_line -x to apply the configuration changes.