Apache proxy example - overly complicated?

[NoseyNick]

https://github.com/dani-garcia/vaultwarden/wiki/Proxy-examples for Apache in a sub-location (by @agentdr8) ...
... looks overly-complicated to me, but I suspect there's a really good reason why - please explain...

    <Location /$sublocation/> #adjust here if necessary
        RewriteEngine On
        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteRule /notifications/hub(.*) ws://<SERVER>:<SERVER_PORT>/$sublocation/notifications/hub/$1 [P,L]
        RewriteRule /notifications/anonymous-hub(.*) ws://<SERVER>:<SERVER_PORT>/fjbitwarden/notifications/anonymous-hub/$1 [P,L]
        ProxyPass http://<SERVER>:<SERVER_PORT>/$sublocation
        ProxyPreserveHost Off
        RequestHeader set X-Real-IP %{REMOTE_ADDR}s
        RequestHeader setifempty Connection "Upgrade"
        RequestHeader setifempty Upgrade "websocket"
    </Location>

Firstly, I suspect .../fjbitwarden/notifications/... should be .../$sublocation/notifications/...
... but why can't this whole <Location> block simply be...

  <Location /vault/>
    ProxyPass http://<SERVER>:<SERVER_PORT>/$sublocation/ upgrade=websocket
    ProxyPreserveHost On
    RequestHeader set X-Real-IP %{REMOTE_ADDR}s
  </Location>

Are the RewriteConds and RewriteRules helping? Aren't they rewriting to the same place?
And the RequestHeader setifempty - needed?
There's probably a really good (security-related?) reason why the extra complexity?
Or is it all just a leftover artifact of the days when the websocket push service was on a different port/path?

[BlackDex]

If this works for all current supported versions of Apache httpd, then feel free to change the wiki. That is where wiki's are for.

[tessus]

That's exactly the problem...

Apache 2.4 has been around for a long time, thus the short version of upgrading websockets only works with Apache httpd >= 2.4.47.

@NoseyNick btw, you should also use ProxyRequests Off. I know it is the default, but I like to be on the safe side. e.g. in a hosted env, you might not have access to the virtual host itself but only the location. In such a case the virtual host could have set it to On.

[NoseyNick]

Ah, I see, so the ProxyPass [...] upgrade=websocket requires 2.4.47?
That's probably the "really good reason why" 😀

Any other good reasons? Security, for example?

[tessus]

see also #3598 (comment)

[tessus]

Ah, I see, so the ProxyPass [...] upgrade=websocket requires 2.4.47?

Yes.

Any other good reasons?

Nope.

[NoseyNick]

Updated the wiki, thanks 👍