Configuring Quality Management Suite client to run behind a reverse proxy providing SSL termination (Optional)

It may be desirable to run the QMS client web application behind a reverse proxy that provides SSL termination services to improve performance, scalability, or simplify infrastructure management. The web client services http requests on the port bound to the website in IIS, reporting requests on port 8031, recording playback requests on port 8038 and live audio monitoring requests on port 4533. The base URLs for reporting and live audio monitoring are determined at runtime from the QMS client configuration specific to using SSL. Running behind a proxy providing SSL termination SSL is turned off in the backend application host so the reporting and live monitor URLs will be http based. This causes a mixed content condition in most browsers because the original client URL is https based with the SSL termination occurring at the proxy, but reporting and live monitor URLs will be rendered as http to agree with the QMS client SSL setup.

You will need to add treatments at the reverse proxy for the four ports the QMS web application services http traffic on. Secure requests starting with path /QMS are treated by the IIS bound endpoint at the backend, requests starting with /api/reports are treated by port 8031 at the backend and any secure request to 4533 or 8038 are relayed to the respective ports at the backend. Here is a summary of the ports/services involved:

  • Host: IIS, Port: 80/443 - IIS serves the majority of the client webpages, except for the content listed below:

  • Host: QMS data service, Port: 8038 - this service hosts any recordings for playback. In the browser these will appear as media links e.g. <audio src="https://qms-data-service-host:8038/recordings/..." />

  • Host: QMS data service, Port: 8031 - this service hosts the reporting service. In the browser these will appears as JSON POST requests to https://qms-client-url:8031/api/reports/...

  • Host: QMS recording service, Port: 4533 - this service hosts the live monitoring source. In the browser these will appear as an audio link e.g. <audio src="https://qms-recording-service-host:4533..." />

You can add Address Overrides to your data service and recording service to ensure that these hostnames are DNS resolvable externally.

X-Forwarded Headers (desired method)

In addition to any administration at the reverse proxy server to provide the SSL termination, by configuring the proxy to append the following standard headers to any traffic passing through will ensure the correct http scheme and hostname for the client URL is automatically adjusted by QMS without the need for any additional configuration. Most proxy servers will add these headers by default

  • X-Forwarded-Host - this should be the hostname of the originating client URL from the browser on the external side of the proxy

  • X-Forwarded-Proto - this should be the http scheme of the originating client URL from the browser on the external side of the proxy (most likely https)

  • X-Forwarded-Port - this should be the http port of the originating client URL from the browser on the external side of the proxy (this is likely to be the standard https port 443, it would be very unusual to be using non-standard http ports on the external side)

QMS will interpret these headers (most commonly the X-Forwarded-Proto header) and if the header indicicates the originating request was SSL enabled, then the URL’s associated with recording playback, reporting services and live monitoring will automatically be upgraded to HTTPS as well.

Fallback Method (deprecated)

If you are unable to configure the proxy to append the X-Forwarded headers, the fallback is to use the configuration setting ForceHostSchemeToHttps in the appsettings.json file to resolve this issue. Complete the following steps:

  1. Open the appsettings.json file for editing (found in the QMS Client IIS directory, which is normally C:\Inetpub\wwwroot\QMS\appsettings.json)

  2. Add a key value pair in the appSettings scope with keyname ForceHostSchemeToHttps and value true. The IIS pool will need to be recycled to pickup this change.