HTTPS login with Spring Security redirects to HTTP

Question

I have a Spring web app, secured with Spring Security, running on EC2. In front of the EC2 instance is an Elastic Load Balancer with an SSL cert (https terminates at the load balancer ie. port 443 -> port 80), so from Tomcat's perspective, inbound requests are HTTP.

My login form submits to https, however the subsequent redirect goes to http (success or fail). The authentication was successful, and I can go back to https and I'm logged in.

My login configuration looks like so:

<security:form-login
    default-target-url="/home"
    login-page="/"
    login-processing-url="/processlogin"
    authentication-failure-url="/?login_error=1"/>

What do I need to change to make default-target-url and authentication-failure-url go to https?

Tomcat 6
Spring Security 3.0.x

I've setup an Apache rewrite in the mean time, but still curious if there's a way to do with within Spring Security config. — Thody, Apr 30 '12 at 19:08
usually it is done at load balancer and configuration is called url-rewrite. This way load balancer makes sure that redirect stays at https. — Ritesh, May 01 '12 at 03:01

score 31 · Answer 1 · edited Apr 08 '15 at 12:13

Your spring configuration should be agnostic to the used protocol. If you use something like "requires-channel", you'll run into problems sooner or later, especially if you want to deploy the same application to a development environment without https.

Instead, consider to configure your tomcat properly. You can do this with RemoteIpValve. Depending on which headers the loadbalancer sends, your server.xml configuration needs to contain something like this:

<Valve
   className="org.apache.catalina.valves.RemoteIpValve"
   internalProxies=".*"
   protocolHeader="X-Forwarded-Proto"
   httpsServerPort="443"
   />

Spring will determine the absolute redirect address based on the ServletRequest, so change the httpsServerPort if you are using something else than 443:

The httpsServerPort is the port returned by ServletRequest.getServerPort() when the protocolHeader indicates https protocol

The actual code which loads http scheme from servlet request can be found from: https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/web/util/UrlUtils.html From there one can find out that, Spring actually collects http scheme from servlet request. So @marcelj solution is the perfect answer for this! — Imtiaz Shakil Siddique, Oct 24 '19 at 08:55

score 15 · Answer 2 · answered May 08 '18 at 14:58

15

If it is a Spring Boot application (I use currently the 2.0.0 release), the following configuration within the application.properties file should be enough:

server.tomcat.protocol-header=x-forwarded-proto

This worked for me on AWS with an load balancer at the front.

For Spring Boot < 2.0.0 it should also work (not tested)

answered May 08 '18 at 14:58

Rolch2015

1,354
1
14
20

This issue had been driving me crazy. This suggestion worked perfectly. Thanks! – John A Sep 10 '18 at 14:25
3

Thanks! I also had to add `server.use-forward-headers=true` https://docs.spring.io/spring-boot/docs/current/reference/html/howto-embedded-web-servers.html#howto-use-tomcat-behind-a-proxy-server – Jeff Sheets Jan 29 '19 at 20:01

score 5 · Answer 3 · answered Dec 12 '18 at 20:50

I had the same problem with Spring Boot behind Google Kubernetes. Adding these two lines to application.properties did it for me

server.tomcat.remote-ip-header=x-forwarded-for
server.tomcat.protocol-header=x-forwarded-proto

Source: https://docs.spring.io/spring-boot/docs/current/reference/html/howto-security.html#howto-enable-https

score 3 · Answer 4 · answered Oct 28 '19 at 22:07

3

Solution was two fold

(1) application.yml

server:
  use-forward-headers: true

(2) in servers /etc/apache2/sites-enabled/oow.com-le-ssl.conf

RequestHeader set X-Forwarded-Proto https
RequestHeader set X-Forwarded-Port 443

(2.1) and enabled the apache module with

sudo a2enmod headers

Put it together with the help of this and this

answered Oct 28 '19 at 22:07

Mihkel L.

1,543
1
27
42

2

`server.use-forward-headers=true` is [deprecated](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.2-Release-Notes#deprecations-in-spring-boot-22). Instead, use `server.forward-headers-strategy=native`, and **DO NOT** set it to `framework` unless you trust your reverse-proxy ;-). – jumping_monkey Apr 03 '20 at 02:09
We were faced with the error **"The information you're about to submit is not secure"** on chrome. To solve the problem we added **server.forward-headers-strategy: native** to application.yml and added the following line to traefik in our docker compose **"traefik.frontend.headers.customResponseHeaders=X-Forwarded-Proto:https||X-Forwarded-Port:443"** – vilvic Dec 14 '20 at 23:42

score 2 · Answer 5 · edited Sep 23 '12 at 06:23

One way I got this working is by adding the following config

<http auto-config="true" use-expressions="true" entry-point-ref="authenticationEntryPoint" >
    <form-login login-page="/login.jsf" authentication-failure-url="/login.jsf?login_error=t" always-use-default-target="true" default-target-url="xxxxx" />
    <logout logout-url="/logout" logout-success-url="/logoutSuccess.jsf" />
    ...
</http>

Had to add always-use-default-target="true" and default-target-url="https://....". Not the ideal way as you need to hard code the url in the config.

score 0 · Answer 6 · answered Jan 22 '14 at 04:50

0

I set requires-channel="any" on all intercept-urls. This allows it to still work in my dev environment where I don't use SSL.

<intercept-url pattern="/createUser" access="permitAll" requires-channel="any"/>
<intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" requires-channel="any"/>
<intercept-url pattern="/**" access="isAuthenticated()" requires-channel="any"/>

Then, create an apache virtual host that redirects all traffic to the HTTPS version.

<VirtualHost *:80>
  ServerName www.mywebsite.com
  Redirect permanent / https://www.mywebsite.com/
</VirtualHost>

answered Jan 22 '14 at 04:50

Andrew Westberg - BCSH

823
1
11
18

6

After login, Spring will still send a Location header with a http address. The user won't notice, because your apache will instantly redirect him to https again, but it is still a serious security problem, because the browser will send the session cookies over an unsecure channel. – marcelj Feb 04 '14 at 14:06
@marcelj - I just ran it through firebug and you're correct. I'll try to figure out a better solution and revise my answer if I do. – Andrew Westberg - BCSH Feb 05 '14 at 15:08
@marcelj, Could you explain why this is a serious security risk or provide a reference that describes the risk? – Nathan Ward Dec 28 '14 at 15:09
@NathanWard If an attacker intercepts the HTTP request, she can serve a HTTP login form and retrieve the credentials. – Paŭlo Ebermann Jan 19 '15 at 14:14

score 0 · Answer 7 · answered Mar 15 '14 at 06:36

I am also facing exactly same problem and till the time I get proper solution I am redirecting my requests from proxy server to tomcat server over AJP instead of HTTP. Below is my apache configuration

ProxyPass /myproject ajp://localhost:8009/myproject
ProxyPassReverse /myproject ajp://localhost:8009/myproject

score 0 · Answer 8 · answered Sep 13 '14 at 11:59

use below lines of code in web.xml

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Login and Restricted Space URLs</web-resource-name>
    <url-pattern>/j_security_check</url-pattern>
    <url-pattern>/loginpage.rose</url-pattern>
  </web-resource-collection>
  <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

it makes forced to use HTTPS.

score 0 · Answer 9 · answered Jan 06 '19 at 21:45

0

In my case, I had to REMOVE the property server.use-forward-headers=true.

This is my setup:

Digital Ocean LB --> Kubernetes cluster with Ingress --> Spring boot Application

answered Jan 06 '19 at 21:45

CelinHC

1,857
2
27
36

score 0 · Answer 10 · answered Jun 28 '21 at 04:57

Tried everything mentioned above for my k8's to spring boot application, problem was k8 was secured and ssl was handled by SSL accelerator sitting in front of ingress. The application only received http requests and spring security also forwarded to http, which was never found. The solution that worked for me:

nginx.ingress.kubernetes.io/proxy-redirect-from: http://$http_host/ nginx.ingress.kubernetes.io/proxy-redirect-to: https://$http_host/$namespace/helloworld-service/

HTTPS login with Spring Security redirects to HTTP

10 Answers10

Linked