Quick reminder about HTTP

From a TCP point of view, HTTP protocol is stateless. This means the TCP connection may be closed after each response sent by a server. This is the Connection-Close mode. HTTP also supports sending multiple requests over a single TCP connection. This is the Keep-Alive mode.

It's up to the client and the server to negotiate the the HTTP mode they're going to use.

HTTP modes in HAProxy

When mode http is turned on, HAProxy processes HTTP protocol for each request and response passing through.

HAProxy supports a few keywords to define its compatibility with HTTP Connection-Close or Keep-Alive modes for the flow being processed. It may be set up in the frontend or backend section. HAProxy's processing mode is defined by the combination of these options set up in the frontend and backend crossed by the flow being processed.

Below is a list of modes and options that support them:

The effective mode that will be applied to a connection passing through a frontend and a backend is determined by both proxy modes according to the following matrix. In short, the modes are symmetric, keep-alive is the weakest option and forceclose is the strongest:

Keep Alive (KAL) mode

This is the default mode, set when no other options are setup.

In this mode, HAProxy tries to keep connections opened on both the client and the server side. Each client has its dedicated server side connection and both remains opened after the last response, until the next query or a timeout occurs.

KAL has the lowest latency on both the client and the server and in case of high request rate, it will be the fastest one.

It is mandatory when NTLM authentication is an application requirement.

This mode is recommended when load-balancing static or cache servers or application server if the application doesn't suffer from a too high number of established connections.

To enable it, both the frontend and the backend must be set to option http-keep-alive.

The connection on the server side may be closed in two cases:

• Content switching: the current request has been forwarded to another backend, hence a different server

• Load-balancing algorithm elected a new server in the backend

To avoid the second case, it is possible to set the option option prefer-last-server in the backend section.

When set up in the defaults section, you can use no option http-keep-alive to disable it locally in a frontend or backend.

The Tunnel (TUN) mode

In this mode, HAProxy analyzes the first request and the first response of each incoming connection, then it estblishes a tunnel between the client and the server and let them talk together without furhter analyzis of HTTP protocol.

By design, this mode has impact over the following features, which apply to the first request and response in the session only:

• No logs generated

• HTTP header parsing

• HTTP header manipulation

• Cookie processing

• Content switching

• Insertion of X-Forwarded-For header

To enable it, either the frontend or the backend must be set to option http-tunnel and none of the following modes below should be set:

• Passive Close (PCL) mode

• Server Close (SCL) mode

• Force Close (FCL) mode

When setup in the defaults section, you can use no option http-tunnel to disable it locally in a frontend or backend.

Passive Close (PCL) mode

In this mode, HAProxy works in HTTP tunnel mode and set or force the HTTP Connection: close header in both client and server directions. If not set, it adds it. Each peer of each connection (client or server side) should close the connection on their own.

It might happen that some servers or clients ignores the Connection: close header and keep the connection alive. To force the close of the connection, HAProxy can actively do it using the force-close mode.

To enable it, either the frontend or the backend must be set to option httpclose and none of the following option below should be set:

• Server Close (SCL) mode

• Force Close (FCL) mode

When setup in the defaults section, you can use no option httpclose to disable it locally in a frontend or backend.

Server Close (SCL) mode

In this mode, HAProxy works in keep-alive mode on the client side and in connection-close mode on the server side.

It provides the latency on the client side (slow network) and the fastest session reuse on the server side to save server resources. It also permits non-keepalive capable servers to be served in keep-alive from a client perspective.

To enable it, either the frontend or the backend must be set to option http-server-close and none of the following option below should be set:

• Force Close (FCL) mode

When setup in the defaults section, you can use no option http-server-close to disable it locally in a frontend or backend.

Force Close (FCL) mode

In this mode, HAProxy actively closes the TCP connection on the server side as soon as it has received the whole response.

To enable it, either the frontend or the backend must be set to option forceclose.

When setup in the defaults section, you can use no option forceclose to disable it locally in a frontend or backend.

Configuration examples

defaults
  option http-server-close

defaults
  option http-keep-alive

...
backend b_myapp
  option http-server-close

defaults
  option http-server-close

...

frontend f_myapp_ntlm
  bind 10.0.0.1:80
  option http-keep-alive
  default_backend b_myapp_ntlm

backend b_myapp_ntlm
  option http-keep-alive
  server s1 10.0.0.11:80 check

backend b_myapp
  option http-server-close
  option http-pretend-keepalive