port forwarding issues / cannot upload images

[System Administrator]

hi support,

we have 4 different servers behind our waf firewall:

1. hipchat self hosted server
2. confluence
3. jira
4. database-mysql for jira+confluence

also: we do not have any proxy HA unit / server installed.

as diagram, all the servers behind the firewall, have internet connection.

I create for each of them: jira+confluence+hipchat servers port fowarding for our public ip address and I linked between them.

our issues is: once I try to connect from external (with public ip address+port: example: office.citsl.net:8090 for Confluence server) we cannot upload any images.

we received error messages like:

{code}Your session has expired. You may need to re-submit the form or reload the page.{code}

but I can confirm: internally (via LAN = same network) if I used that DNS/ip address for Confluence Server, I can upload images with no issues.

the only popup message appearing is:

{code}

Your URL doesn't match

Confluence's base URL is set to http://office.citsl.net:8090 but you are accessing Confluence from http://confluence.citsl:8090.

Update base URL

{code}

Technical Q: what I can do to change / accept via port forwarding upload images into Confluence Server?

Thanks,

Peter

[AnnWorley · Accepted solution]

Hi Peter,

I understand you can upload files to Confluence when you access it on the local LAN, using http://confluence.citsl:8090 you can upload attachments but when you use the external address http://office.citsl.net:8090 the upload fails with a message indicating your session has expired.

Since the port forwarding is allowing us to access Confluence on a different name from the machine's hostname, it is acting as a reverse proxy. For this reason we should make sure the server.xml has proxy support in the connector directive. Here is a good explanation of how this works: Apache Tomcat Configuration Reference

The proxyName and proxyPort attributes can be used when Tomcat is run behind a proxy server. These attributes modify the values returned to web applications that call the request.getServerName() and request.getServerPort() methods, which are often used to construct absolute URLs for redirects. Without configuring these attributes, the values returned would reflect the server name and port on which the connection from the proxy server was received, rather than the server name and port to whom the client directed the original request.

The connector is configured in <Confluence Install>/conf/server.xml. Please look for a block of code like:

<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol" />

And add the proxyName, proxyPort and scheme, for example:

<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol" proxyName="office.citsl.net" proxyPort="8090" scheme="http"/>

I look forward to hearing whether adding the proxy support to Tomcat is of help. Thanks!

[System Administrator]

thanks is working now.

[AnnWorley]

That's great news! Did it start working after the server.xml was edited or did you fix it some other way?

(I am asking for the sake of the next person who searches the Community when images won't upload for them.)

[System Administrator]

yes, everything is good and I made the same changes for jira as well. obviously with different port.

thanks again

[Avinash Singh]

<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol"
 scheme="https" secure="true" proxyName="confluence.xxx.com" proxyPort="443"/>

 Im having the same issue with external users outside of our networks having issues uploading to confluence. We are using the f5 as our reverse proxy. Internally we can upload fine.