Proxy and Capture
If you installed and configured IG with a router and default route as described in Getting Started Guide, then you already proxy and capture the application requests coming in and the server responses going out.
This template route uses a DispatchHandler to change the scheme to HTTPS on login:
{
"heap": [
{
"name": "ReverseProxyHandler",
"type": "ReverseProxyHandler",
"comment": "Testing only: blindly trust the server cert for HTTPS.",
"config": {
"tls": {
"type": "ClientTlsOptions",
"config": {
"trustManager": {
"type": "TrustAllManager"
}
}
},
"hostnameVerifier": "ALLOW_ALL"
}
}
],
"handler": {
"type": "DispatchHandler",
"config": {
"bindings": [
{
"condition": "${request.uri.path == '/login'}",
"handler": "ReverseProxyHandler",
"baseURI": "https://app.example.com:8444"
},
{
"condition": "${request.uri.scheme == 'http'}",
"handler": "ReverseProxyHandler",
"baseURI": "http://app.example.com:8081"
},
{
"handler": "ReverseProxyHandler",
"baseURI": "https://app.example.com:8444"
}
]
}
},
"condition": "${matches(request.uri.query, 'demo=capture')}"
}To try this example with the sample application:
Add the following route to IG:
$HOME/.openig/config/routes/20-capture.json
%appdata%\OpenIG\config\routes\20-capture.json
Add the following route to serve static resources, such as .css, for the sample application:
$HOME/.openig/config/routes/static-resources.json
%appdata%\OpenIG\config\routes\static-resources.json
{ "name" : "sampleapp_resources", "baseURI" : "http://app.example.com:8081", "condition": "${matches(request.uri.path,'^/css')}", "handler": "ReverseProxyHandler" }Go to http://openig.example.com:8080/login?demo=capture.
The login page of the sample application is displayed.
To use this as a default route with a real application:
Replace the test ReverseProxyHandler with one that is configured to trust the application's public key server certificate. Otherwise, use a ReverseProxyHandler that references a truststore holding the certificate.
Configure the ReverseProxyHandler to strictly verifiy hostnames for outgoing SSL connections.
In production, do not use
TrustAllManagerfor TrustManager, orALLOW_ALLfor hostname verification. For information, see "ReverseProxyHandler".Change the baseURI settings to match the target application.
Remove the route-level condition on the handler that specifies a
demoquery string parameter.