diff --git a/pom.xml b/pom.xml
index 1d6366f052bc6ced20f141e550c4669311e7aca5..e265b30f1fc7510f4918cef91d6daee5bebeab3c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -254,7 +254,7 @@
<dependency>
<groupId>com.corundumstudio.socketio</groupId>
<artifactId>netty-socketio</artifactId>
- <version>1.7.15</version>
+ <version>1.7.16</version>
</dependency>
<dependency>
<groupId>javax.inject</groupId>
@@ -403,7 +403,7 @@
<artifactId>jetty-maven-plugin</artifactId>
<version>9.4.11.v20180605</version>
<configuration>
- <scanIntervalSeconds>1</scanIntervalSeconds>
+ <scanIntervalSeconds>0</scanIntervalSeconds>
<webApp>
<overrideDescriptor>src/main/webapp/WEB-INF/web-dev.xml</overrideDescriptor>
<webInfIncludeJarPattern>^$</webInfIncludeJarPattern>
diff --git a/src/main/java/de/thm/arsnova/controller/LoginController.java b/src/main/java/de/thm/arsnova/controller/LoginController.java
index b99f744412080b1e78c49f8ec498b18a15b73683..10e1bd4b0062961b845274bb13eef2a24115c7f2 100644
--- a/src/main/java/de/thm/arsnova/controller/LoginController.java
+++ b/src/main/java/de/thm/arsnova/controller/LoginController.java
@@ -258,14 +258,9 @@ public class LoginController extends AbstractController {
failureUrl = "/";
}
- /* Handle proxy
- * TODO: It might be better, to support the proposed standard: http://tools.ietf.org/html/rfc7239 */
- String host = null != request.getHeader("X-Forwarded-Host")
- ? request.getHeader("X-Forwarded-Host") : request.getServerName();
- int port = null != request.getHeader("X-Forwarded-Port")
- ? Integer.valueOf(request.getHeader("X-Forwarded-Port")) : request.getServerPort();
- String scheme = null != request.getHeader("X-Forwarded-Proto")
- ? request.getHeader("X-Forwarded-Proto") : request.getScheme();
+ final String host = request.getServerName();
+ final int port = request.getServerPort();
+ final String scheme = request.getScheme();
String serverUrl = scheme + "://" + host;
if ("https".equals(scheme)) {
@@ -432,34 +427,4 @@ public class LoginController extends AbstractController {
return authList;
}
-
- @RequestMapping(value = { "/test/me" }, method = RequestMethod.GET)
- @ResponseBody
- public User me() {
- final User me = userSessionService.getUser();
- if (me == null) {
- throw new UnauthorizedException();
- }
- return me;
- }
-
- @RequestMapping(value = { "/test/mysession" }, method = RequestMethod.GET)
- @ResponseBody
- public Session mysession() {
- final Session mysession = userSessionService.getSession();
- if (mysession == null) {
- throw new UnauthorizedException();
- }
- return mysession;
- }
-
- @RequestMapping(value = { "/test/myrole" }, method = RequestMethod.GET)
- @ResponseBody
- public UserSessionService.Role myrole() {
- final UserSessionService.Role myrole = userSessionService.getRole();
- if (myrole == null) {
- throw new UnauthorizedException();
- }
- return myrole;
- }
}
diff --git a/src/main/resources/log4j.properties b/src/main/resources/log4j.properties
index b0ce03ef63b955e000ce00d8b17bf33c639a66dd..799d4daee3a37f557deb25d0b5e03546d736662c 100644
--- a/src/main/resources/log4j.properties
+++ b/src/main/resources/log4j.properties
@@ -13,3 +13,5 @@ log4j.category.io.netty=WARN
log4j.category.io.netty.channel.DefaultChannelPipeline=ERROR
log4j.category.net.sf.json=WARN
log4j.category.org.springframework=INFO
+log4j.category.org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping=WARN
+log4j.category.org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping=WARN
diff --git a/src/site/markdown/installation.md b/src/site/markdown/installation.md
index 755cf4a3d810976d1aeacde4d39a2eef73ddcebb..60ba3cfdff6a15f2e4219983068695651a94d379 100644
--- a/src/site/markdown/installation.md
+++ b/src/site/markdown/installation.md
@@ -55,11 +55,11 @@ In order to build up a full featured server installation you have to install at
* Apache HTTP Server 2.4.5 (or newer) with builtin modules `mod_proxy`, `mod_proxy_http`, `mod_proxy_wstunnel` and `mod_rewrite`
Additionally, you need Python 2.7 (3.0 or newer will not work) to run the "Setup Tool".
-We further recommend installing the "Apache Portable Runtime Library" (libapr1) for improved performance.
+We further recommend installing the "Apache Portable Runtime (APR) based Native library for Tomcat" (libapr and libtcnative) for improved performance.
Most of this software can easily be installed on Linux systems using the distribution's package manager:
-* Debian: `# apt-get install -t jessie-backports nginx openjdk-8-jre && apt-get install libapr1 tomcat8`
-* Ubuntu: `# sudo apt-get install couchdb libapr1 nginx openjdk-8-jre tomcat8`
+* Debian: `# apt-get install -t jessie-backports nginx openjdk-8-jre && apt-get install libtcnative-1 tomcat8`
+* Ubuntu: `# sudo apt-get install couchdb libtcnative-1 nginx openjdk-8-jre tomcat8`
While running ARSnova without a reverse proxy is possible, we do not recommend to do so.
A reverse proxy significantly simplifies the setup of HTTPS and allows running Websocket connections over the default HTTP(S) port.
@@ -123,6 +123,18 @@ Open `/etc/tomcat8/server.xml`, look for `<Connector port="8080" ...>`, and chan
<Connector port="8080" address="127.0.0.1" ...>
+Additionally, you need to add a
+[Remote IP Valve](https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#Remote_IP_Valve)
+to make Tomcat aware of the `X-Forwarded` headers injected by the reverse proxy.
+Look for the `<Host name="localhost" ...>` section and add:
+
+ <Valve className="org.apache.catalina.valves.RemoteIpValve"
+ internalProxies="127\.0\.0\.1"
+ remoteIpHeader="x-forwarded-for"
+ protocolHeader="x-forwarded-proto" />
+
+If the reverse proxy is not running locally, you need to adjust the regular expression for `internalProxies` accordingly.
+
### Web Application
@@ -148,9 +160,8 @@ Add the following lines to the `server` section of the file:
location = /arsnova-config { proxy_pass http://localhost:8080/api/configuration/; }
location /api {
proxy_pass http://localhost:8080;
+ proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_set_header X-Forwarded-Host $host;
- proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /socket.io/ {
@@ -158,8 +169,6 @@ Add the following lines to the `server` section of the file:
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- proxy_set_header Host $host;
}
Create a symbolic link in `/etc/nginx/sites-enabled` to the `arsnova` site configuration file.
@@ -178,6 +187,7 @@ Add the following lines to the `VirtualHost` section of the file:
ProxyPass http://localhost:8080/api/
ProxyPassReverse http://localhost:8080/api/
ProxyPreserveHost On
+ RequestHeader set X-Forwarded-Proto %{REQUEST_SCHEME}
</Location>
<Location /socket.io/>
ProxyPass ws://localhost:8090/socket.io/