When your app is set "behind" the reverse proxy all requests have to be sent via https to the ctrlX CORE and will be checked by the authentication server. After this is done the requester will get a token including all rights for the system. With this token the requester can now send htpps requests without authenticate again. Internally this messages will now be handled in http but your app will have to check the authorization for its own functions. The proxy only knows the right but does not know what to do with it.
... View more