Handling ATG redirects in weblogic when SSL termination happens at webserver
In many ATG implementations, ATG storefront application server instances will be load balanced behind a web server (ex: Apache, Nginx etc…). In some cases the web server is also used as an SSL accelerator (SSL certificates are deployed on web server instead of app server) to offload processor intensive public-key encryption algorithms from the application server. In such scenarios, one of the issues we face is that the application server code is unaware that a request is SSL request unless it examines the URL (http vs https) or the protocol (as SSL tunnel is terminated at web server). To compound the problem, different application servers have different logic to determine if the current request is a secure request or not.
Most ATG formhandlers include code to redirect to a JSP after business logic and the general practice is to provide the relative path of the JSP and not provide the entire URL with the http/https protocol indicator. In such cases, the application server is expected to determine the protocol of the redirect URL based on the protocol of the originating request.
In a specific ATG implementation, I was using Weblogic as the application server and in this scenario if the formhandler POST was done on SSL, ATG was redirecting back to non-secure URL (http instead of https). After going through weblogic documentation, it turns out that Weblogic expects a specific header to be added to the request when SSL request termination happens before the request reaches weblogic.
Following is the change to be done on nginx webserver for adding the header needed by Weblogic:
server {
listen 443;
location /myapp {
proxy_pass http://weblogic-inst:7001/myapp;
proxy_set_header Host $host;
proxy_set_header WL-Proxy-SSL true;
}
}
I have skipped most of the other configuration in nginx as that is beyond the scope of this post.
Similarly, for apache the config change would look as follows:
<Proxy balancer://myapp>
RequestHeader set WL-Proxy-SSL true
BalancerMember http://weblogic-instance:7001
</Proxy>
If you are using Big-IP as your SSL accelerator, a similar change will be needed on Big-IP.
Other application servers like IBM Websphere may have a different way of identifying secure request. I will cover that in a different post.
Update 30-Apr-2013:
Just found this link from IBM support site on handling this condition in Websphere server
