www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00
Code Activity

Merge r1937809 from trunk:

Browse Source 
add a warning to elaborate on string-matching



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1937810 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Eric Covener
2026-09-03 12:30:06 +00:00
parent 16a5c1777b
commit e8d288a300
1 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
docs/manual/mod/mod_proxy.xml
View File

@@ -505,8 +505,9 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10
<usage>
<p>Directives placed in <directive type="section">Proxy</directive>
sections apply only to matching proxied content using a simple string prefix match against the URL. Shell-style wildcards are also
allowed.</p>
sections apply only to matching proxied content using a simple string
prefix match against the URL. Shell-style wildcards are also allowed.
</p>
<p>For example, the following will allow only hosts in
<code>yournetwork.example.com</code> to access content via your proxy
@@ -528,6 +529,14 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10
&lt;/Proxy&gt;
</highlight>
<note type="warning"><title>Warning</title>
This configuration section does not canonicalize any part of the string
being matched such as schemes, hostnames, IP addresses, etc. Care should be
taken if using it for access control, including but not limited to
denying access by default and allowing expected hostnames rather than the
inverse where a denial could be bypassed by using alternate forms.
</note>
<note><title>Differences from the Location configuration section</title>
<p>A backend URL matches the configuration section if it begins with the
the <var>wildcard-url</var> string, even if the last path segment in the
@@ -591,6 +600,14 @@ proxied resources</description>
type="section">Proxy</directive> directive, except that it matches URLs
using <glossary ref="regex">regular expressions</glossary>.</p>
<note type="warning"><title>Warning</title>
This configuration section does not canonicalize any part of the string
being matched such as schemes, hostnames, IP addresses, etc. Care should be
taken if using it for access control, including but not limited to
denying access by default and allowing expected hostnames rather than the
inverse where a denial could be bypassed by using alternate forms.
</note>
<p>From 2.4.8 onwards, named groups and backreferences are captured and
written to the environment with the corresponding name prefixed with
"MATCH_" and in upper case. This allows elements of URLs to be referenced