title: Apache OpenMeetings 4.0.4 CSRF attack when using apache2 as proxypass
body: <p>I've got Apache OpenMeetings 4.0.4 witch Apache/2.2.22 as proxy.</p>
  
  <p>In OM's conf/red5.properties I've got</p>
  
  <pre><code>http.port=8080
  </code></pre>
  
  <p>I want to do two things:</p>
  
  <ol>
  <li><p>Redirect HTTP (80) -> HTTPS (443)</p></li>
  <li><p>Redirect HTTP (8080) to HTTPS (443)</p></li>
  </ol>
  
  <p>My /etc/apache2/sites-avilable/default conf is:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
      ServerName domain.test-test.eu
      ServerAlias domain.test-test.eu
  
      RewriteEngine On
      RewriteCond %{HTTPS} off
      RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
  &lt;/VirtualHost&gt;
  
  &lt;VirtualHost *:8080&gt;
      ServerName domain.test-test.eu
      ServerAlias domain.test-test.eu
  
      RewriteEngine On
      RewriteCond %{HTTPS} off
      RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>My /etc/apache2/sites-avilable/default-ssl conf is:</p>
  
  <pre><code>&lt;VirtualHost *:443&gt;
      ServerName domain.test-test.eu
      ServerAlias domain.test-test.eu
  
      ProxyRequests Off
      ProxyPreserveHost On
  
      ProxyPass / http://localhost:8080/
      ProxyPassReverse / http://localhost:8080/
  
      SSLEngine On
      SSLCerificateFile /etc/apache2/certs/collaboration.crt
      SSLCerificateKeyFile /etc/apache2/certs/collaboration.key
      SSLCerificateChainFile /etc/apache2/certs/chain.pem
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>When I type <a href="http://domain.test-test.eu/" rel="nofollow noreferrer">http://domain.test-test.eu/</a> it redirects me to <a href="https://domain.test-test.eu" rel="nofollow noreferrer">https://domain.test-test.eu</a>.</p>
  
  <p>When I type <a href="http://192.168.XXX.YYY" rel="nofollow noreferrer">http://192.168.XXX.YYY</a> it redirects me to <a href="https://192.168.XXX.YYY" rel="nofollow noreferrer">https://192.168.XXX.YYY</a></p>
  
  <p>But when I type <a href="http://192.168.XXX.YYY:8080" rel="nofollow noreferrer">http://192.168.XXX.YYY:8080</a> or <a href="http://domain.test-test.eu:8080" rel="nofollow noreferrer">http://domain.test-test.eu:8080</a> it doesn't redirect me to <a href="https://192.168.XXX.YYY" rel="nofollow noreferrer">https://192.168.XXX.YYY</a> or <a href="https://domain.test-test.eu/" rel="nofollow noreferrer">https://domain.test-test.eu/</a>. The page opens up (without HTTPS).</p>
  
  <p>The second problem is, that in OM's log I can see CSRF info and I can't log in through HTTPS.</p>
  
  <p>Info from OM's log:</p>
  
  <pre><code>[http-nio-0.0.0.0-8080-exec-10] INFO o.a.w.p.h.CsrfPreventionRequestCycleListener - Possible CSRF attack, request URL: http://192.168.XXX.YYY/openmeetings/wicket/bookmarkable/org.apache.openmeetings.web.pages.auth.SignInPage, Origin: https://192.168.XXX.YYY, action: aborted with error 400 Origin does not correspond to request
  </code></pre>
  
  <p>How should I change Apache settings to make it work?</p>