HTTPS URL is resulting with 404 - Adobe Experience Manager
Recently, we have faced the issue with https URL's, the
URL's with masked path (/en/test.html) is not working with https protocol.
However, the unmasked (/content/site/en/test.html) URL is
working, also http URL is working without any issues.
Based on our analysis, it looks to be the system is not
honoring the /etc/map.publish/https mapping for https request and due to that
the content path(without full path - /en/test.html) is not accessible and 404
is displayed
Our case the request is https from browser and the Load
Balancer terminate the SSL and forward the request to dispatcher - Load
Balancer notify the dispatcher that the initial request is https via header
X-Forwarded-Proto (this header value differs based on the load balancer)
The dispatcher send the request to publisher with required
headers and publisher consider the request as https based on the above header
and match the Resource Mapping accordingly - /etc/map.publish/https
The 404 will be displayed for masked URL's if publisher not
able to match the /etc/map.publish/https for incoming request.
How to resolve?
Option1:
- Match the SSL Filter settings to those expected from the entity where SSL is terminated (Load Balancer). You can check these values forwarded in the dispatcher.log file and make sure they match to those of the SSL Filter. Configure the SSL Filter (Apache Felix Http Service SSL Filter) in Publisher with SSL forward header and value
- Allow the following headers in dispatcher farm file /clientheaders section, if /clientheaders section is not set to allow all
X-Forwarded-Proto (this header value change based on the
Load balancer)
- other known values X-FORWARDED-SSL, X-Forwarded-Protocol and Front-End-Https
- other known values X-FORWARDED-SSL, X-Forwarded-Protocol and Front-End-Https
X-Forwarded-Port
- White list the SSL headers mentioned above in CDN, if CDN is enabled in the flow.
Option2:
Disallow the SSL forward headers in dispatcher farm file
/clientheaders section; disallow the following header - X-Forwarded-Proto in
/clientheaders section, review the "Apache Felix Http Service SSL
Filter" in publisher to identify the exact header value used to identify
the forwarded SSL request.
This allow the publisher to consider the request as http and
match the /etc/map.publish/http node for incoming requests.
In cases the SSL is terminated at the Web server, follow the below steps:
At the bottom of the httpd.conf add the following
configuration: RequestHeader set X-Forwarded-Port "-1"
Allow the X-Forwarded-Port header in dispatcher farm file if
/clientheaders section is not set to allow all
