Task: Use CodeSonar with a Reverse Proxy

• General Requirements
• Example: NGINX
• Links

General Requirements

Reverse proxy behaviors such as buffering, caching, and timeouts can interfere with communication between the CodeSonar analysis and the hub.

Configuring your reverse proxy to allow CodeSonar to work correctly will generally include the following.

• Buffering. Disable response buffering and request buffering.
  CodeSonar uses long poll responses for hub communication. These responses must be pipelined rather than buffered in their entirety.
• Caching. Disable caching.
• Timeouts Set appropriately long read and connect timeouts.
  CodeSonar's long poll responses can last indefinitely, so we recommend setting timeouts to be longer than the duration of the longest CodeSonar analysis you expect to perform.
• HTTP X-Forwarded-For header. The proxy should set the X-Forwarded-For header to the address of the HTTP client.
  This is especially important in contexts like distributed analysis, where the IP address of the analysis master must be available to the hub so it can be communicated to other processes.
• Response forwarding. Forward non-200 responses to the client (don't convert into a "bad gateway").

Note: It is not possible to use certificate-based hub authentication in the presence of a proxy or reverse proxy. TLS client authentication is designed to prevent "man in the middle" attacks and the reverse proxy is a man in the middle.

Example: NGINX

The following NGINX configuration will allow CodeSonar to work correctly.

http {

    server {
        ...
        ...

        location / {
            ...
            ...
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_buffering off;
            proxy_cache off;
            proxy_request_buffering off;
            proxy_read_timeout 1w;
            proxy_connect_timeout 300s;
        }
    }
}

For more information about these settings, see the following links.

• proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for
• proxy_buffering
• proxy_cache
• proxy_request_buffering
• proxy_read_timeout
• proxy_connect_timeout

Links

• Typical CodeSonar Tasks
• The CodeSonar Hub