diff --git a/include/http_protocol.h b/include/http_protocol.h

index 9ccac89..20bd202 100644

--- a/include/http_protocol.h

+++ b/include/http_protocol.h

@@ -96,6 +96,13 @@ AP_DECLARE(void) ap_get_mime_headers(request_rec *r);

 AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r,

                                           apr_bucket_brigade *bb);

+/**

+ * Run post_read_request hook and validate.

+ * @param r The current request

+ * @return OK or HTTP_...

+ */

+AP_DECLARE(int) ap_post_read_request(request_rec *r);

+

 /* Finish up stuff after a request */

 /**

diff --git a/modules/http/http_request.c b/modules/http/http_request.c

index c9ae5af..d59cfe2 100644

--- a/modules/http/http_request.c

+++ b/modules/http/http_request.c

@@ -680,7 +680,7 @@ static request_rec *internal_internal_redirect(const char *new_uri,

      * to do their thing on internal redirects as well.  Perhaps this is a

      * misnamed function.

      */

-    if ((access_status = ap_run_post_read_request(new))) {

+    if ((access_status = ap_post_read_request(new))) {

         ap_die(access_status, new);

         return NULL;

     }

diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c

index ee4f1fb..ff9f81d 100644

--- a/modules/proxy/mod_proxy.c

+++ b/modules/proxy/mod_proxy.c

@@ -777,11 +777,12 @@ static int proxy_detect(request_rec *r)

     if (conf->req && r->parsed_uri.scheme) {

         /* but it might be something vhosted */

-        if (!(r->parsed_uri.hostname

-              && !ap_cstr_casecmp(r->parsed_uri.scheme, ap_http_scheme(r))

-              && ap_matches_request_vhost(r, r->parsed_uri.hostname,

-                                          (apr_port_t)(r->parsed_uri.port_str ? r->parsed_uri.port

-                                                       : ap_default_port(r))))) {

+        if (!r->parsed_uri.hostname

+            || ap_cstr_casecmp(r->parsed_uri.scheme, ap_http_scheme(r)) != 0

+            || !ap_matches_request_vhost(r, r->parsed_uri.hostname,

+                                         (apr_port_t)(r->parsed_uri.port_str

+                                                      ? r->parsed_uri.port

+                                                      : ap_default_port(r)))) {

             r->proxyreq = PROXYREQ_PROXY;

             r->uri = r->unparsed_uri;

             r->filename = apr_pstrcat(r->pool, "proxy:", r->uri, NULL);

@@ -2021,6 +2022,7 @@ static const char *

     struct proxy_alias *new;

     char *f = cmd->path;

     char *r = NULL;

+    const char *real;

     char *word;

     apr_table_t *params = apr_table_make(cmd->pool, 5);

     const apr_array_header_t *arr;

@@ -2107,6 +2109,10 @@ static const char *

     if (r == NULL) {

         return "ProxyPass|ProxyPassMatch needs a path when not defined in a location";

     }

+    if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, r))) {

+        return "ProxyPass|ProxyPassMatch uses an invalid \"unix:\" URL";

+    }

+

     /* if per directory, save away the single alias */

     if (cmd->path) {

@@ -2123,7 +2129,7 @@ static const char *

     }

     new->fake = apr_pstrdup(cmd->pool, f);

-    new->real = apr_pstrdup(cmd->pool, ap_proxy_de_socketfy(cmd->pool, r));

+    new->real = apr_pstrdup(cmd->pool, real);

     new->flags = flags;

     if (worker_type & AP_PROXY_WORKER_IS_MATCH) {

         new->regex = ap_pregcomp(cmd->pool, f, AP_REG_EXTENDED);

@@ -2649,6 +2655,7 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg)

     proxy_worker *worker;

     char *path = cmd->path;

     char *name = NULL;

+    const char *real;

     char *word;

     apr_table_t *params = apr_table_make(cmd->pool, 5);

     const apr_array_header_t *arr;

@@ -2689,6 +2696,9 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg)

         return "BalancerMember must define balancer name when outside <Proxy > section";

     if (!name)

         return "BalancerMember must define remote proxy server";

+    if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, name))) {

+        return "BalancerMember uses an invalid \"unix:\" URL";

+    }

     ap_str_tolower(path);   /* lowercase scheme://hostname */

@@ -2701,8 +2711,7 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg)

     }

     /* Try to find existing worker */

-    worker = ap_proxy_get_worker(cmd->temp_pool, balancer, conf,

-                                 ap_proxy_de_socketfy(cmd->temp_pool, name));

+    worker = ap_proxy_get_worker(cmd->temp_pool, balancer, conf, real);

     if (!worker) {

         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, cmd->server, APLOGNO(01147)

                      "Defining worker '%s' for balancer '%s'",

@@ -2799,9 +2808,14 @@ static const char *

         }

     }

     else {

+        const char *real;

+

+        if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, name))) {

+            return "ProxySet uses an invalid \"unix:\" URL";

+        }

+

         worker = ap_proxy_get_worker_ex(cmd->temp_pool, NULL, conf,

-                                        ap_proxy_de_socketfy(cmd->temp_pool, name),

-                                        worker_type);

+                                        real, worker_type);

         if (!worker) {

             if (in_proxy_section) {

                 err = ap_proxy_define_worker_ex(cmd->pool, &worker, NULL,

@@ -2944,9 +2958,14 @@ static const char *proxysection(cmd_parms *cmd, void *mconfig, const char *arg)

             }

         }

         else {

+            const char *real;

+

+            if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, conf->p))) {

+                return "<Proxy/ProxyMatch > uses an invalid \"unix:\" URL";

+            }

+

             worker = ap_proxy_get_worker_ex(cmd->temp_pool, NULL, sconf,

-                                            ap_proxy_de_socketfy(cmd->temp_pool, conf->p),

-                                            worker_type);

+                                            real, worker_type);

             if (!worker) {

                 err = ap_proxy_define_worker_ex(cmd->pool, &worker, NULL, sconf,

                                                 conf->p, worker_type);

diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h

index 044a6c4..c21c4d8 100644

--- a/modules/proxy/mod_proxy.h

+++ b/modules/proxy/mod_proxy.h

@@ -751,6 +751,7 @@ PROXY_DECLARE(int) ap_proxy_worker_can_upgrade(apr_pool_t *p,

 #define AP_PROXY_WORKER_IS_PREFIX   (1u << 0)

 #define AP_PROXY_WORKER_IS_MATCH    (1u << 1)

 #define AP_PROXY_WORKER_IS_MALLOCED (1u << 2)

+#define AP_PROXY_WORKER_NO_UDS      (1u << 3)

 /**

  * Get the worker from proxy configuration, looking for either PREFIXED or

diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c

index 8225045..cbe300f 100644

--- a/modules/proxy/proxy_util.c

+++ b/modules/proxy/proxy_util.c

@@ -1741,7 +1741,12 @@ PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker_ex(apr_pool_t *p,

         return NULL;

     }

+    if (!(mask & AP_PROXY_WORKER_NO_UDS)) {

     url = ap_proxy_de_socketfy(p, url);

+        if (!url) {

+            return NULL;

+        }

+    }

     c = ap_strchr_c(url, ':');

     if (c == NULL || c[1] != '/' || c[2] != '/' || c[3] == '\0') {

@@ -2323,22 +2328,22 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,

     access_status = proxy_run_pre_request(worker, balancer, r, conf, url);

     if (access_status == DECLINED && *balancer == NULL) {

-        *worker = ap_proxy_get_worker(r->pool, NULL, conf, *url);

+        const int forward = (r->proxyreq == PROXYREQ_PROXY);

+        *worker = ap_proxy_get_worker_ex(r->pool, NULL, conf, *url,

+                                         forward ? AP_PROXY_WORKER_NO_UDS : 0);

         if (*worker) {

             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

                           "%s: found worker %s for %s",

                           (*worker)->s->scheme, (*worker)->s->name, *url);

-            *balancer = NULL;

-            if (!fix_uds_filename(r, url)) {

+            if (!forward && !fix_uds_filename(r, url)) {

                 return HTTP_INTERNAL_SERVER_ERROR;

             }

             access_status = OK;

         }

-        else if (r->proxyreq == PROXYREQ_PROXY) {

+        else if (forward) {

             if (conf->forward) {

                 ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

                               "*: found forward proxy worker for %s", *url);

-                *balancer = NULL;

                 *worker = conf->forward;

                 access_status = OK;

                 /*

@@ -2352,8 +2357,8 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,

         else if (r->proxyreq == PROXYREQ_REVERSE) {

             if (conf->reverse) {

                 ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

-                              "*: using default reverse proxy worker for %s (no keepalive)", *url);

-                *balancer = NULL;

+                              "*: using default reverse proxy worker for %s "

+                              "(no keepalive)", *url);

                 *worker = conf->reverse;

                 access_status = OK;

                 /*

diff --git a/server/protocol.c b/server/protocol.c

index 3d74c5b..2214f72 100644

--- a/server/protocol.c

+++ b/server/protocol.c

@@ -1548,7 +1548,7 @@ request_rec *ap_read_request(conn_rec *conn)

     /* we may have switched to another server */

     apply_server_config(r);

-    if ((access_status = ap_run_post_read_request(r))) {

+    if ((access_status = ap_post_read_request(r))) {

         goto die;

     }

@@ -1603,6 +1603,27 @@ ignore:

     return NULL;

 }

+AP_DECLARE(int) ap_post_read_request(request_rec *r)

+{

+    int status;

+

+    if ((status = ap_run_post_read_request(r))) {

+        return status;

+    }

+

+    /* Enforce http(s) only scheme for non-forward-proxy requests */

+    if (!r->proxyreq

+            && r->parsed_uri.scheme

+            && (ap_cstr_casecmpn(r->parsed_uri.scheme, "http", 4) != 0

+                || (r->parsed_uri.scheme[4] != '\0'

+                    && (apr_tolower(r->parsed_uri.scheme[4]) != 's'

+                        || r->parsed_uri.scheme[5] != '\0')))) {

+        return HTTP_BAD_REQUEST;

+    }

+

+    return OK;

+}

+

 /* if a request with a body creates a subrequest, remove original request's

  * input headers which pertain to the body which has already been read.

  * out-of-line helper function for ap_set_sub_req_protocol.