How can I set up a reverse proxy for MATLAB Web App Server using Apache HTTP Server?

I am using MATLAB Web App Server behind a separate reverse proxy server -- that is, users connect to the proxy server and have their requests routed to the backend MATLAB Web App Server. Users do not connect directly to the MATLAB Web App Server machine, nor do they ever see its IP address or hostname.
However, when I enable this following basic Apache documentation, I see websockets warnings in the web app session log. This impacts performance of my web app.
How can I configure my Apache proxy to properly route traffic (including websockets) to MATLAB Web App Server?

Answer 1

[MathWorks Support Team]

MATLAB Web App Server uses websockets to improve performance. You will need to make additional changes in your proxy configuration for Apache to properly route websocket traffic to and from MATLAB Web App Server. 

The following configuration was confirmed to work with MATLAB Web App Server R2024b:

Listen 443 https

<VirtualHost *:443>
    ProxyPreserveHost on

    SSLProxyEngine On
    SSLCertificateFile '/etc/apache2/certs/cert.pem' #certificate for *.mydomain.com
    SSLCertificateKeyFile '/etc/apache2/certs/key.pem' #private key for *.mydomain.com

    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off

    ErrorLog /var/log/apache2/MWAS_error.log
    TransferLog /var/log/apache2/MWAS_transfer.log

    ProxyPass / https://<MWAShostname>.mydomain.com:9988/ upgrade=websocket
    ProxyPassReverse / https://<MWAShostname>.mydomain.com:9988/

</VirtualHost>

Notes:

• This was used for an environment where both MATLAB Web App Server and Apache had SSL enabled (i.e. all HTTPS/WSS traffic).
• This setup used the same certificate for both the proxy and the MATLAB Web App Server. This certificate used a wildcard to match the common name for both servers.
• Make sure to set ProxyPreserveHost to 'on' -- this is off by default.
• The "upgrade=websocket" parameter is only supported in Apache 2.4.47 and later (see Protocol Upgrade). For earlier versions, remove this parameter and add the following lines: 

      RewriteEngine on
      RewriteCond %{HTTP:Upgrade} websocket [NC]
      RewriteCond %{HTTP:Connection} upgrade [NC]
      RewriteRule ^/?(.*) "wss://<MWAShostname>.mathworks.com:9988/$1" [P,L]

• If you are using OIDC authentication, ensure the redirect URL in webapps_authn.json points to the proxy.