IBM i Web Applications - Configuring for Proxy Environments

Step 1: Set com.ibm.trustedProxies

The property com.ibm.trustedProxies needs to list the proxy IP addresses to trust for the Admin and Admin3 servers:

com.ibm.trustedProxies=1.2.3.4

If multiple IP addresses are needed, they can be appended with comma separation with no spaces. Below is an example with two IP addresses:

com.ibm.trustedProxies=1.2.3.4,5.6.7.8

The IP Addresses of 1.2.3.4 and 5.6.7.8 are examples, these need to be replaced with IP addresses that correspond to the proxy server(s) being configured for. At the time of this page being published, there is no support for CIDR notation for this value. Each entry must be a numeric IP address literal — hostnames (e.g. proxy.example.com) are not supported and will be silently ignored. Both IPv4 and IPv6 literals are accepted.

With the above information in mind, set the trustedProxies property for the intended Admin server with the following command from QShell:

/QIBM/ProdData/OS/ApplicationServer/bin/setapplicationserverproperties.sh -server 'Admin1' -jvmProperty 'com.ibm.trustedProxies=1.2.3.4,5.6.7.8’

The "X-Forwarded-For" header is only used by IBM i web applications in the event that the trustedProxies property is defined and set. Otherwise it is not or used for Session IP binding. 

Step 2: Set com.ibm.allowedOrigins 

For both Admin1 and Admin3, these servers need to have the allowed WebSocket upgrade origins specified on the property com.ibm.allowedOrigins. This is only required when the IBM i web apps are deployed behind a reverse proxy that rewrites the Host header (e.g. a load balancer using a custom public domain or non-standard port). If there is only one origin needed, the following value is sufficient:

com.ibm.allowedOrigins=https://server1.example.com

If multiple origins are needed, they can be appended with comma separation. Below is an example with two origins, one determining port number as well:

com.ibm.allowedOrigins=https://server1.example.com,http://server2.example.com:8080

Each entry must be a full origin string in the format scheme://host[:port]. At the time of this page being published, there is no support for wildcard or CIDR-style notation for this value — each entry is matched exactly against the Origin header sent by the browser.

With the above information in mind, set the allowedOrigins property for the intended Admin server with the following command from QShell:

/QIBM/ProdData/OS/ApplicationServer/bin/setapplicationserverproperties.sh -server 'Admin1' -jvmProperty 'com.ibm.allowedOrigins=https://navigator.example.com,http://proxy.internal:8080’