I'm currently migrating an old application using Spring Boot 2.0.x to more recent Spring Boot 2.3.x version. The app is deployed on OpenShift behind a reverse-proxy (apache) to handle the SSL certificate.
The app is using a openid-connect system to authenticate the user. Basically the openid-connect server redirects the user to /login (via redirect-uri) and after, via a custom implementation of Spring class SavedRequestAwareAuthenticationSuccessHandler and his method "onAuthenticationSuccess", we redirect the user to /profile via a default redirect strategy.
@Slf4j
@RequiredArgsConstructor
@Component
public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
private final RedirectStrategy redirectStrategy;
@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
// We do some stuff here...
log.debug("Redirecting to /profile");
log.debug("request.getScheme() = " + request.getScheme());
log.debug("request.getContextPath() = " + request.getContextPath());
log.debug("request.getRequestURI() = " + request.getRequestURI());
log.debug("request.getRequestURL() = " + request.getRequestURL().toString());
log.debug("request.getServletPath() = " + request.getServletPath());
redirectStrategy.sendRedirect(request, response, "/profile");
}
}
With the Spring Boot version 2.0.x, no problem, everything was working fine. After the migration to Spring Boot version 2.3.x, the user was redirect to http://INTERNAL_OPENSHIFT_HOST/ourApp/profile
I found the "new" parameter introduced since Spring Boot 2.2 called server.forward-headers-strategy. If I set the value to "framework", then the redirect is done to http://REVERSE_PROXY_HOST/ourApp/profile
And well... I have no idea why http is used instead of https! I suppose everything is correctly setup on the reverse-proxy side because well everything was fine with Spring Boot 2.0.x!
I probably miss something... another parameter of something similar but I'm currently stuck on that point... Any idea?