How to avoid Wicket redirecting page from HTTPS to HTTP

Question

I use wicket 8.10, it is installed on tomcat and proxied by nginx. SSL certificates configured in nginx config. Also Nginx forwards all HTTP requests to HTTPS.

The problem is following:

When I submit any form wicket returns response headers where the Location tag contains url with HTTP protocol.

Why it is important:

The last chrome update makes browser show alert when Location contains HTTP protocol on page opened by HTTPS. Before that, nginx quietly redirected the request, but now user see alert page from browser (similar to when certificate is invalid or absence).

user_497381 · Answer

The problem here is that your Wicket application does not know that it is behind a proxy.

There are two solutions:

use XForwardedRequestWrapperFactory

It will wrap the Tomcat's HttpServletRequest with one that reads X-Forwarded-*** request headers. Just make sure that Nginx exports X-Forwarded-Proto request header

use HttpsMapper

Just overwrite protected Scheme getDesiredSchemeFor(Class pageClass) to return Scheme.HTTPS in PRODUCTION mode and Scheme.HTTP in DEVELOPMENT mode (I assume you don't use Nginx proxy while developing)

user_633012 · Answer

The simplest solution I have found is to use the nginx directive:

proxy_redirect http://example.com https://example.com;

It changes location header from http://example.com/any/path to https://example.com/any/path

How to avoid Wicket redirecting page from HTTPS to HTTP

2 Answers