Why does mod_jk bypass Apache authorization? -


since switching apache 2.2 authorization gets bypassed many jkmounts (except jk-status). if cancel browser password popup, 401-page. not, expect, 1 apache, instead jboss, shouldn't have been allowed talk to. (i found because unauthorized users talking jboss.)

on receiving end have both jboss 4 , wildfly 7. both "apache/2.4.3 (unix) mod_jk/1.2.37" , "apache/2.4.10 (unix) mod_jk/1.2.40". configuration like

<location /xyz/*>     jkmount xyz     authtype basic     authuserfile conf/passwd/xyz     authname "xyz security"     require valid-user </location> 

i have case identical setup (worker definition, <location>, file permission , content) works on 2.4.3 not on 2.4.10. other jkmounts both versions both behave wrongly. if raise debug level, don't see how parses this. when call url, says there no directive protecting it.

it turns out nested 1-arg syntax of jkmount pretty useless, because requires trailing wildcard, while location doesn't understand it. works pulling out:

jkmount /xyz/* xyz <location /xyz> 

Comments

Popular posts from this blog

javascript - Jquery show_hide, what to add in order to make the page scroll to the bottom of the hidden field once button is clicked -

javascript - Highcharts multi-color line -

javascript - Enter key does not work in search box -