Index: httpd-2.2.34/modules/proxy/ajp.h
===================================================================
--- httpd-2.2.34.orig/modules/proxy/ajp.h	2020-04-14 14:14:54.871365937 +0200
+++ httpd-2.2.34/modules/proxy/ajp.h	2020-04-14 14:16:32.923868272 +0200
@@ -413,11 +413,13 @@ apr_status_t ajp_ilink_receive(apr_socke
  * @param r         current request
  * @param buffsize  max size of the AJP packet.
  * @uri uri         requested uri
+ * @param secret    authentication secret
  * @return          APR_SUCCESS or error
  */
 apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
                              apr_size_t buffsize,
-                             apr_uri_t *uri);
+                             apr_uri_t *uri,
+                             const char *secret);
 
 /**
  * Read the ajp message and return the type of the message.
Index: httpd-2.2.34/modules/proxy/ajp_header.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/ajp_header.c	2014-07-16 00:07:19.000000000 +0200
+++ httpd-2.2.34/modules/proxy/ajp_header.c	2020-04-14 14:16:50.651959088 +0200
@@ -211,7 +211,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
 
 static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
                                           request_rec *r,
-                                          apr_uri_t *uri)
+                                          apr_uri_t *uri,
+                                          const char *secret)
 {
     int method;
     apr_uint32_t i, num_headers = 0;
@@ -292,17 +293,15 @@ static apr_status_t ajp_marshal_into_msg
                    i, elts[i].key, elts[i].val);
     }
 
-/* XXXX need to figure out how to do this
-    if (s->secret) {
+    if (secret) {
         if (ajp_msg_append_uint8(msg, SC_A_SECRET) ||
-            ajp_msg_append_string(msg, s->secret)) {
+            ajp_msg_append_string(msg, secret)) {
             ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
-                   "Error ajp_marshal_into_msgb - "
+                   "ajp_marshal_into_msgb: "
                    "Error appending secret");
             return APR_EGENERAL;
         }
     }
- */
 
     if (r->user) {
         if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
@@ -651,7 +650,8 @@ static apr_status_t ajp_unmarshal_respon
 apr_status_t ajp_send_header(apr_socket_t *sock,
                              request_rec *r,
                              apr_size_t buffsize,
-                             apr_uri_t *uri)
+                             apr_uri_t *uri,
+                             const char *secret)
 {
     ajp_msg_t *msg;
     apr_status_t rc;
@@ -663,7 +663,7 @@ apr_status_t ajp_send_header(apr_socket_
         return rc;
     }
 
-    rc = ajp_marshal_into_msgb(msg, r, uri);
+    rc = ajp_marshal_into_msgb(msg, r, uri, secret);
     if (rc != APR_SUCCESS) {
         ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
                "ajp_send_header: ajp_marshal_into_msgb failed");
Index: httpd-2.2.34/modules/proxy/mod_proxy.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/mod_proxy.c	2020-04-14 14:14:54.747365303 +0200
+++ httpd-2.2.34/modules/proxy/mod_proxy.c	2020-04-14 15:03:37.394294757 +0200
@@ -290,6 +290,11 @@ static const char *set_worker_param(apr_
         worker->conn_timeout = timeout;
         worker->conn_timeout_set = 1;
     }
+    else if (!strcasecmp(key, "secret")) {
+        if (strlen(val) > PROXY_WORKER_MAX_SECRET_SIZE)
+            return "Secret length must be < 64 characters";
+        strcpy(worker->s->route, val);
+    }
     else {
         return "unknown Worker parameter";
     }
Index: httpd-2.2.34/modules/proxy/mod_proxy.h
===================================================================
--- httpd-2.2.34.orig/modules/proxy/mod_proxy.h	2020-04-14 14:14:54.871365937 +0200
+++ httpd-2.2.34/modules/proxy/mod_proxy.h	2020-04-14 14:50:08.310167629 +0200
@@ -293,6 +293,7 @@ PROXY_WORKER_DISABLED | PROXY_WORKER_STO
 /* default worker retry timeout in seconds */
 #define PROXY_WORKER_DEFAULT_RETRY  60
 #define PROXY_WORKER_MAX_ROUTE_SIZ  63
+#define PROXY_WORKER_MAX_SECRET_SIZE     64
 
 /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
  * dotted together(?) this would fit the below size (+ trailing NUL).
@@ -324,6 +325,7 @@ typedef struct {
 #if PROXY_HAS_SCOREBOARD
     unsigned char   digest[APR_MD5_DIGESTSIZE]; /* hash of the worker->name */
 #endif
+    const char      secret[PROXY_WORKER_MAX_SECRET_SIZE];
 } proxy_worker_stat;
 
 /* Worker configuration */
Index: httpd-2.2.34/modules/proxy/mod_proxy_ajp.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/mod_proxy_ajp.c	2015-06-05 18:50:47.000000000 +0200
+++ httpd-2.2.34/modules/proxy/mod_proxy_ajp.c	2020-04-14 14:25:17.598556104 +0200
@@ -190,6 +190,7 @@ static int ap_proxy_ajp_request(apr_pool
     apr_off_t content_length = 0;
     int original_status = r->status;
     const char *original_status_line = r->status_line;
+    const char *secret = NULL;
 
     if (psf->io_buffer_size_set)
        maxsize = psf->io_buffer_size;
@@ -199,12 +200,15 @@ static int ap_proxy_ajp_request(apr_pool
        maxsize = AJP_MSG_BUFFER_SZ;
     maxsize = APR_ALIGN(maxsize, 1024);
        
+    if (*conn->worker->s->secret)
+        secret = conn->worker->s->secret;
+
     /*
      * Send the AJP request to the remote server
      */
 
     /* send request headers */
-    status = ajp_send_header(conn->sock, r, maxsize, uri);
+    status = ajp_send_header(conn->sock, r, maxsize, uri, secret);
     if (status != APR_SUCCESS) {
         conn->close++;
         ap_log_error(APLOG_MARK, APLOG_ERR, status, r->server,
