Apache HTTPD / Representation, proxying, and capacity / Lesson 9

Reverse proxy paths and response rewriting

Trace frontend and backend URLs while keeping forward proxying, Host, redirects, and application behavior distinct.

About 4 min readContent reviewed 2026-10-28

On this page

Lesson goals

Explain ProxyPass and ProxyPassReverse roles.
Review prefix boundaries, backend authority, and response limits without making connections.

A reverse proxy serves a controlled backend path

A reverse proxy accepts a frontend request and forwards selected work to a configured backend. A forward proxy serves a different client-selected destination model. Parcel’s /api/ can map to a synthetic HTTP backend while static documentation remains local. ProxyRequests Off does not disable reverse ProxyPass mapping; it avoids enabling the forward-proxy role in this illustration. mod_proxy and the relevant protocol provider are required. No proxy, backend, socket, request, or service is started or contacted by this course.

Prefix and slash contracts matter

ProxyPass maps a frontend scope to a backend URL, and matching trailing-slash conventions affect the path sent upstream. Ordering and exclusions also matter when routes overlap. Review the exact prefix rather than assuming /api and /api/ are identical in every configuration. The backend URL is a trusted configuration input, not an arbitrary client-provided target. Keep its scheme, host, port, path, and permitted reachability explicit. A reverse-proxy rule can carry network authority even when the application user never receives backend credentials.

Read one bounded proxy illustration

The fragment below maps a synthetic API prefix and declares reverse redirect rewriting. The backend hostname uses the reserved nonworking example.invalid domain. It is not a complete virtual host and is never loaded. ProxyPassReverse adjusts supported response header URLs such as Location; it does not rewrite every HTML body, JavaScript URL, or cookie path automatically. Review cookie and application-generated public URL behavior separately. A successful backend response can still redirect the browser to an unintended internal or mismatched external address.

apache A non-runnable reverse-proxy fragment

ProxyRequests Off
ProxyPass "/api/" "http://backend.example.invalid:9000/"
ProxyPassReverse "/api/" "http://backend.example.invalid:9000/"

The protocol modules, frontend configuration, backend, access policy, and network are absent assumptions. No DNS lookup, connection, HTTP operation, or proxy authorization is performed.

Host and scheme are application contracts

An application can use Host, forwarded scheme, and related metadata to construct redirects, cookies, links, or access decisions. Decide what the trusted frontend supplies and what the backend expects; ProxyPreserveHost is a behavior choice, not a universal remedy. Do not trust arbitrary client forwarding headers as authenticated identity. Backend TLS verification, when used, is another boundary with its own supported configuration. Preserve exact response and bounded error evidence when diagnosing 502, 504, wrong redirects, or mixed-content behavior rather than increasing every timeout.

Transform a declared known path locally

The complete local model below strips one known frontend prefix and appends the suffix to a declared backend base. It performs text manipulation only and is not Apache’s proxy matcher, URL normalization, SSRF defense, or HTTP client. The input excludes encoded or ambiguous path forms. Its purpose is showing that /api/labels can correspond to /labels upstream under the declared rule. Actual diagnostics need the selected site, route, backend observation, and response-header contract from a separately authorized evidence path.

python A limited synthetic proxy-path model

frontend = "/api/labels"
prefix = "/api/"
backend = "http://backend.example.invalid:9000/"
assert frontend.startswith(prefix)
print(backend + frontend[len(prefix):])
print("text mapping only")

Expected output

http://backend.example.invalid:9000/labels
text mapping only

No URL is fetched and no network or filesystem is accessed. This string operation must not be used to accept arbitrary client-supplied backend URLs.

Common errors and fixes

ProxyRequests On is enabled merely to make reverse proxying work.

Why it happens: Forward and reverse proxy roles were confused.
How to fix it: Use the intended supported reverse mapping and review access independently.
Prevent it next time: Keep the proxy role and permitted destination contract explicit.

ProxyPassReverse is assumed to rewrite all application content.

Why it happens: Supported response-header rewriting was stretched into arbitrary body transformation.
How to fix it: Review public URL generation, cookies, and body links separately.
Prevent it next time: Test redirects and application navigation as distinct outcomes.

A bad backend response is treated as proof that every timeout is too short.

Why it happens: Connection, protocol, routing, and application failures were collapsed.
How to fix it: Inspect the exact gateway evidence and affected boundary.
Prevent it next time: Change one justified timeout or routing assumption at a time.

Check your understanding

1. Why does ProxyRequests Off coexist with ProxyPass in the example?

Show worked solution

They address different proxy roles. The illustration avoids enabling forward proxy service while describing a controlled reverse mapping. It does not establish a complete access or network policy, and no proxy is actually run.

2. The backend returns an HTML link to an internal hostname. Must ProxyPassReverse fix that link?