Why does mod_jk bypass Apache authorization? -
since switching apache 2.2 authorization gets bypassed many jkmounts (except jk-status). if cancel browser password popup, 401-page. not, expect, 1 apache, instead jboss, shouldn't have been allowed talk to. (i found because unauthorized users talking jboss.)
on receiving end have both jboss 4 , wildfly 7. both "apache/2.4.3 (unix) mod_jk/1.2.37" , "apache/2.4.10 (unix) mod_jk/1.2.40". configuration like
<location /xyz/*> jkmount xyz authtype basic authuserfile conf/passwd/xyz authname "xyz security" require valid-user </location>
i have case identical setup (worker definition, <location>
, file permission , content) works on 2.4.3 not on 2.4.10. other jkmounts both versions both behave wrongly. if raise debug level, don't see how parses this. when call url, says there no directive protecting it.
it turns out nested 1-arg syntax of jkmount pretty useless, because requires trailing wildcard, while location doesn't understand it. works pulling out:
jkmount /xyz/* xyz <location /xyz>
Comments
Post a Comment