22<html lang="en">
33 <head>
44 <meta charset="utf-8" />
5- <title>HAProxy version 3.2.1-6 - Configuration Manual</title>
5+ <title>HAProxy version 3.2.2 - Configuration Manual</title>
66 <link href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet" />
77 <link href="https://raw.githubusercontent.com/thomaspark/bootswatch/v3.3.7/cerulean/bootstrap.min.css" rel="stylesheet" />
88 <link href="../css/page.css?0.4.2-15" rel="stylesheet" />
46124612 You can use <strong>left</strong> and <strong>right</strong> arrow keys to navigate between chapters.<br>
46134613 </p>
46144614 <p class="text-right">
4615- <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/06/11 </b></small>
4615+ <small>Converted with <a href="https://github.com/cbonte/haproxy-dconv">haproxy-dconv</a> v<b>0.4.2-15</b> on <b>2025/07/02 </b></small>
46164616 </p>
46174617 </div>
46184618 <!-- /.sidebar -->
46234623 <div class="text-center">
46244624 <h1><a href="http://www.haproxy.org/" title="HAProxy"><img src="../img/HAProxyCommunityEdition_60px.png?0.4.2-15" /></a></h1>
46254625 <h2>Configuration Manual</h2>
4626- <p><strong>version 3.2.1-6 </strong></p>
4626+ <p><strong>version 3.2.2 </strong></p>
46274627 <p>
4628- 2025/06/11 <br>
4628+ 2025/07/02 <br>
46294629
46304630 </p>
46314631 </div>
@@ -15456,8 +15456,23 @@ <h2 id="chapter-4.2" data-target="4.2"><small><a class="small" href="#4.2">4.2.<
1545615456desirable in these environments as well, to avoid redistributing the traffic
1545715457after every other response.
1545815458
15459- If this option has been enabled in a "defaults" section, it can be disabled
15460- in a specific instance by prepending the "no" keyword before it.
15459+ It may be useful to precise here, which load balancing algorithms are
15460+ considered deterministic. Deterministic algorithms will always select the same
15461+ server for a given client data, assuming the set of available servers has not
15462+ changed. In general, deterministic algorithms involve hasing or lookups on the
15463+ incoming requests to choose the target server. However, this is not always the
15464+ case; "static-rr", for example, can be also considered as deterministic because
15465+ the server choice is based on the server's static weight, making the selection
15466+ predictable. "sticky" algorithm provides deterministic routing for the
15467+ returning clients.
15468+
15469+ As for non-deterministic algorithms, these algorithms select a server based on
15470+ dynamic server state or simple rotation, so two consecutive requests are not
15471+ guaranteed to land on the same server. option prefer-last-server is designed
15472+ specifically for these. roundrobin, leastconn are examples of such algorithms.
15473+
15474+ If this option has been enabled in a "defaults" section, it can be
15475+ disabled in a specific instance by prepending the "no" keyword before it.
1546115476</pre><div class="page-header"><b>See also:</b> "<a href="#option%20http-keep-alive">option http-keep-alive</a>"</div>
1546215477<a class="anchor" name="option"></a><a class="anchor" name="4-option"></a><a class="anchor" name="4.2-option"></a><a class="anchor" name="option (Proxies)"></a><a class="anchor" name="option (Alphabetically sorted keywords reference)"></a><a class="anchor" name="option redispatch"></a><a class="anchor" name="4-option redispatch"></a><a class="anchor" name="4.2-option redispatch"></a><a class="anchor" name="option redispatch (Proxies)"></a><a class="anchor" name="option redispatch (Alphabetically sorted keywords reference)"></a><div class="keyword"><b><a class="anchor" name="option redispatch"></a><a href="#4.2-option%20redispatch">option redispatch</a></b></div><a class="anchor" name="option"></a><a class="anchor" name="4-option"></a><a class="anchor" name="4.2-option"></a><a class="anchor" name="option (Proxies)"></a><a class="anchor" name="option (Alphabetically sorted keywords reference)"></a><a class="anchor" name="option redispatch"></a><a class="anchor" name="4-option redispatch"></a><a class="anchor" name="4.2-option redispatch"></a><a class="anchor" name="option redispatch (Proxies)"></a><a class="anchor" name="option redispatch (Alphabetically sorted keywords reference)"></a><div class="keyword"><b><a class="anchor" name="option redispatch"></a><a href="#4.2-option%20redispatch">option redispatch</a></b> <span style="color: #080"><interval></span></div><a class="anchor" name="no"></a><a class="anchor" name="4-no"></a><a class="anchor" name="4.2-no"></a><a class="anchor" name="no (Proxies)"></a><a class="anchor" name="no (Alphabetically sorted keywords reference)"></a><a class="anchor" name="no option"></a><a class="anchor" name="4-no option"></a><a class="anchor" name="4.2-no option"></a><a class="anchor" name="no option (Proxies)"></a><a class="anchor" name="no option (Alphabetically sorted keywords reference)"></a><a class="anchor" name="no option redispatch"></a><a class="anchor" name="4-no option redispatch"></a><a class="anchor" name="4.2-no option redispatch"></a><a class="anchor" name="no option redispatch (Proxies)"></a><a class="anchor" name="no option redispatch (Alphabetically sorted keywords reference)"></a><div class="keyword"><b><a class="anchor" name="no option redispatch"></a><a href="#4.2-no%20option%20redispatch">no option redispatch</a></b></div><pre class="text">Enable or disable session redistribution in case of connection failure
1546315478
@@ -20970,6 +20985,10 @@ <h2 id="chapter-5.1" data-target="5.1"><small><a class="small" href="#5.1">5.1.<
2097020985 configuration, the default certificates could be explicited (with a '*'
2097120986 filter) at the beginning of the list, so an implicit default is not added
2097220987 before.
20988+ Due to multi-cert bundles being duplicated for each algorithm in the
20989+ crt-list, only one algorithm will occupy the first line in the crt-list and
20990+ be considered as default. Either specify the entire bundle as default by
20991+ declaring '*' as the filter or setting it on the bind line.
2097320992
2097420993 The "show ssl sni" command on the stats socket could be used to debug your
2097520994 configuration. (See "show ssl sni" in the management guide)
@@ -21230,9 +21249,16 @@ <h2 id="chapter-5.1" data-target="5.1"><small><a class="small" href="#5.1">5.1.<
2123021249</pre><a class="anchor" name="prefer-client-ciphers"></a><a class="anchor" name="5-prefer-client-ciphers"></a><a class="anchor" name="5.1-prefer-client-ciphers"></a><a class="anchor" name="prefer-client-ciphers (Bind and server options)"></a><a class="anchor" name="prefer-client-ciphers (Bind options)"></a><div class="keyword"><b><a class="anchor" name="prefer-client-ciphers"></a><a href="#5.1-prefer-client-ciphers">prefer-client-ciphers</a></b></div><pre class="text">Use the client's preference when selecting the cipher suite, by default
2123121250the server's preference is enforced. This option is also available on
2123221251global statement "<a href="#ssl-default-bind-options">ssl-default-bind-options</a>".
21252+
2123321253Note that with OpenSSL >= 1.1.1 ChaCha20-Poly1305 is reprioritized anyway
2123421254(without setting this option), if a ChaCha20-Poly1305 cipher is at the top of
2123521255the client cipher list.
21256+
21257+ When using a dual algorithms setup (RSA + ECDSA), the selection algorithm
21258+ will chose between RSA and ECDSA and will always prioritize ECDSA. Once the
21259+ right certificate is chosen, it will let the SSL library prioritize ciphers,
21260+ curves etc. Meaning this option can't be used to prioritize an RSA
21261+ certificate over an ECDSA one.
2123621262</pre><a class="anchor" name="proto"></a><a class="anchor" name="5-proto"></a><a class="anchor" name="5.1-proto"></a><a class="anchor" name="proto (Bind and server options)"></a><a class="anchor" name="proto (Bind options)"></a><div class="keyword"><b><a class="anchor" name="proto"></a><a href="#5.1-proto">proto</a></b> <span style="color: #080"><name></span></div><pre class="text">Forces the multiplexer's protocol to use for the incoming connections. It
2123721263must be compatible with the mode of the frontend (TCP or HTTP). It must also
2123821264be usable on the frontend side. The list of available protocols is reported
@@ -24409,11 +24435,14 @@ <h3 id="chapter-7.3.1" data-target="7.3.1"><small><a class="small" href="#7.3.1"
2440924435compiled with USE_OPENSSL.
2441024436</pre><a class="anchor" name="jwt_verify"></a><a class="anchor" name="7-jwt_verify"></a><a class="anchor" name="7.3.1-jwt_verify"></a><a class="anchor" name="jwt_verify (Using ACLs and fetching samples)"></a><a class="anchor" name="jwt_verify (Converters)"></a><div class="keyword"><b><a class="anchor" name="jwt_verify"></a><a href="#7.3.1-jwt_verify">jwt_verify</a></b>(<span style="color: #080"><alg></span>,<span style="color: #080"><key></span>)</div><pre class="text">Performs a signature verification for the JSON Web Token (JWT) given in input
2441124437by using the <alg> algorithm and the <key> parameter, which should either
24412- hold a secret or a path to a public certificate. Returns 1 in case of
24413- verification success, 0 in case of verification error and a strictly negative
24414- value for any other error. Because of all those non-null error return values,
24415- the result of this converter should never be converted to a boolean. See
24416- below for a full list of the possible return values.
24438+ hold a secret or a path to a public key. The public key should either be in
24439+ the PKCS#1 format (for RSA keys, starting with BEGIN RSA PUBLIC KEY) or SPKI
24440+ format (Subject Public Key Info, starting with BEGIN PUBLIC KEY).
24441+ Returns 1 in case of verification success, 0 in case of verification failure
24442+ and a strictly negative value for any other error. Because of all those
24443+ non-null error return values, the result of this converter should never be
24444+ converted to a boolean. See below for a full list of the possible return
24445+ values.
2441724446
2441824447For now, only JWS tokens using the Compact Serialization format can be
2441924448processed (three dot-separated base64-url encoded strings). All the
@@ -24422,16 +24451,16 @@ <h3 id="chapter-7.3.1" data-target="7.3.1"><small><a class="small" href="#7.3.1"
2442224451
2442324452If the used algorithm is of the HMAC family, <key> should be the secret used
2442424453in the HMAC signature calculation. Otherwise, <key> should be the path to the
24425- public certificate that can be used to validate the token's signature. All
24426- the certificates that might be used to verify JWTs must be known during init
24427- in order to be added into a dedicated certificate cache so that no disk
24428- access is required during runtime. For this reason, any used certificate must
24429- be mentioned explicitly at least once in a jwt_verify call. Passing an
24430- intermediate variable as second parameter is then not advised.
24454+ public key that can be used to validate the token's signature. All the public
24455+ keys that might be used to verify JWTs must be known during init in order to
24456+ be added into a dedicated cache so that no disk access is required during
24457+ runtime. For this reason, any used public key must be mentioned explicitly at
24458+ least once in a jwt_verify call. Passing an intermediate variable as second
24459+ parameter is then not advised.
2443124460
2443224461This converter only verifies the signature of the token and does not perform
2443324462a full JWT validation as specified in <a href="#7.2">section 7.2</a> of RFC7519. We do not
24434- ensure that the header and payload contents are fully valid JSON's once
24463+ ensure that the header and payload contents are fully valid JSONs once
2443524464decoded for instance, and no checks are performed regarding their respective
2443624465contents.
2443724466
@@ -24459,7 +24488,7 @@ <h3 id="chapter-7.3.1" data-target="7.3.1"><small><a class="small" href="#7.3.1"
2445924488http-request set-var(txn.bearer) http_auth_bearer
2446024489http-request set-var(txn.jwt_alg) var(txn.bearer),jwt_header_query('$.alg')
2446124490http-request deny unless { var(txn.jwt_alg) -m str "RS256" }
24462- http-request deny unless { var(txn.bearer),jwt_verify(txn.jwt_alg,"/path/to/crt .pem") 1 }
24491+ http-request deny unless { var(txn.bearer),jwt_verify(txn.jwt_alg,"/path/to/pubkey .pem") 1 }
2446324492</code></pre>
2446424493</div><a class="anchor" name="language"></a><a class="anchor" name="7-language"></a><a class="anchor" name="7.3.1-language"></a><a class="anchor" name="language (Using ACLs and fetching samples)"></a><a class="anchor" name="language (Converters)"></a><div class="keyword"><b><a class="anchor" name="language"></a><a href="#7.3.1-language">language</a></b>(<span style="color: #080"><value></span><span style="color: #008">[,<span style="color: #080"><default></span>]</span>)</div><pre class="text">Returns the value with the highest q-factor from a list as extracted from the
2446524494"accept-language" header using "<a href="#req.fhdr">req.fhdr</a>". Values with no q-factor have a
@@ -33050,8 +33079,8 @@ <h2 id="chapter-12.9" data-target="12.9"><small><a class="small" href="#12.9">12
3305033079 <br>
3305133080 <hr>
3305233081 <div class="text-right">
33053- HAProxy 3.2.1-6 – Configuration Manual<br>
33054- <small>, 2025/06/11 </small>
33082+ HAProxy 3.2.2 – Configuration Manual<br>
33083+ <small>, 2025/07/02 </small>
3305533084 </div>
3305633085 </div>
3305733086 <!-- /.col-lg-12 -->
0 commit comments