Issue with HTTPS to HTTP redirection by Elastic Load Balancer to Tomcat server

tomcat spring-security amazon-web-services http-redirect amazon-elb
Anoop Halgeri picture Anoop Halgeri · Mar 29, 2012 · Viewed 9.5k times · Source

I have a ELB (Amazon Elastic Load Balancer) configured to load balance end users requests on HTTPS, on the backend I have my application running on Tomcat server which is configured on HTTP.

So when my end users makes a request to the application the request wil be on HTTPS, since they access the ELB, now, ELB internally redirects it on HTTP to the tomcat server. In tomcat my application is protected through Spring Security and if the request is for a protected resource and the user is not logged in user is redirected to the configured login page. Now, this redirection to the end user will be over HTTP, since the tomcat server had got the request originally from the ELB as HTTP. This will now lead to a 404 since I have not configured for inward traffic on HTTP.

How do we resolve this issue? Is the only option to have HTTPS both on the enduser-ELB and from ELB-tomcat or am i missing some thing here?

Answer

Frederick Cheung picture Frederick Cheung · Mar 29, 2012

ELB sets a X-Forwarded-Proto header that allows you to tell which protocol the client used to connect to your load balancer. See the documentation.

You can configure spring security to look at this header, see this answer for example.

Related questions

Spring Boot with embedded Tomcat behind Apache proxy

We have a Spring Boot (Spring MVC) app with embedded Tomcat on a dedicated appserver behind an Apache SSL proxy. The SSL port on the proxy server is 4433, forwarding to port 8080 on the appserver. So the URL to the proxy …

Read More
How can I prevent spring-security from appending ;jsessionid=XXX to login redirects?

When an unauthenticated client requests a URL that requires a non-anonymous access level as defined in security-config.xml, spring security sends an HTTP redirect to our login page (e.g. /login). That's fine. The issue is that absent an existing …

Read More
BadCredentialsException: Kerberos validation not succesfull

I would like to perform authentification with SPNEGO. I use: spring-core-3.1.0.RELEASE.jar spring-security-core-3.1.0.RELEASE.jar spring-security-kerberos-core-1.0.0.M2.jar package codec from spring core security 3.0.7 (https://jira.springsource.org/browse/SES-98) tomcat My Config file looks like the following. When …

Read More