title: Handling authentication with Apache reverse proxy for plack/PSGI app
body: <p>This is my scenario:</p>
  
  <p><img src="https://i.stack.imgur.com/aOzMd.jpg" alt="Apache-reverse-proxy-starman"></p>
  
  <p>So,</p>
  
  <ol>
  <li>Requests via encrypted HTTPS go to Apache like: <code>https://server1/MyPerlApp</code></li>
  <li>If the user is not logged in, they get a redirect to some login page (in the server1), and  Apache doesn't proxy the request to Server2</li>
  <li>When the user logged in - IS authenticated - then Apache forwards all requests that are coming to <code>https://server1/MyPerlApp</code> to <code>http://server2:5000</code></li>
  </ol>
  
  <p>Question1: Is this possible? (Asking, because I don't know Apache enough deeply, and this is not an simple:</p>
  
  <pre><code>ProxyPass /MyPerlApp http://server2:5000/
  </code></pre>
  
  <p>because I need need authenticate the user at server1 and set <code>ProxyPass</code> Only if authenticated.
  Since Apache is quite flexible I assume the answer is yes for the above (but <em>confirmation and details is very welcomed</em>) - so here are my main specific questions:</p>
  
  <ul>
  <li>How will my Plack application  know <strong>what user</strong> is authenticated at the Apache level (<em>i.e.</em> on the 1st server)?</li>
  <li>what is an easy way to deliver <em>some</em> of the user info to the <code>perl</code> app on the server2? <em>e.g.</em> with Apache's <code>mod_rewrite</code> what appends an <code>user=username</code> parameter to each query,</li>
  <li>can Apache can set some HTTP headers that my <code>perl</code> app should read?</li>
  <li>is there an easy and recommenced way?</li>
  </ul>
  
  <p>I'm looking for how to avoid authentication routines in my starman/perl app, maily because:</p>
  
  <ul>
  <li>the user need to log into server1 anyway (for other tasks in his workflow)</li>
  <li>if he is already logged in, authentication in my app is not needed (avoid unnecessary double login)</li>
  <li>but I still need to know <strong>which users are logged in</strong> (via Apache at server1)</li>
  </ul>
  
  <p>There is already similar questions, but:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/q/12561830/734304">https://stackoverflow.com/q/12561830/734304</a> (<em>no answer</em>)</li>
  <li><a href="https://stackoverflow.com/q/11907797/734304">https://stackoverflow.com/q/11907797/734304</a> (<em>no answer</em>)</li>
  <li><a href="https://stackoverflow.com/q/5011102/734304">Apache reverse proxy with basic authentication</a> (<em>similar, but the backend is in the same server and same apache</em>)</li>
  </ul>