Can I insert request headers into an SSL / HTTPS request using a proxy?

Question

I am currently using apaches mod_proxy / mod_proxy_http / mod_headers as a direct proxy to add (overwrite) cookie request headers to the following request:

<Proxy *> Order deny,allow Allow from all RequestHeader set Cookie "mycookie=1234" </Proxy> 

(Of course, I don’t have permission from everyone and *, but for simplicity and reproduction this is just fine)

Now I want to do the same for ssl connection. I downloaded mod_proxy_connect, which makes ssl work fine, but the header insert does not work.

This makes sense because SSL is end2end and should not be changed in transit.

However, I want to do this. I think the server needs to be a man in the middle. To do this, you need your own SSL certificate, which will be invalid for the domain, but this can be added as an exception. Can this be done using a reverse proxy?

Another thing that I would be cool with (which I would prefer) would be to map the ssl connection to a regular http connection.

Any suggestions are welcome!

Answer 1

Perhaps, but this is an SSL security violation, so you won’t find a white hat feature for this.

SSLStrip can proxy HTTPS to HTTP and convert links and redirect on the fly.