Spring Boot 2.3.2 server.forward-headers-strategy=framework redirects to scheme http instead of https

Viewed 1021

I'm currently migrating an old application using Spring Boot 2.0.x to more recent Spring Boot 2.3.x version. The app is deployed on OpenShift behind a reverse-proxy (apache) to handle the SSL certificate.

The app is using a openid-connect system to authenticate the user. Basically the openid-connect server redirects the user to /login (via redirect-uri) and after, via a custom implementation of Spring class SavedRequestAwareAuthenticationSuccessHandler and his method "onAuthenticationSuccess", we redirect the user to /profile via a default redirect strategy.

@Slf4j
@RequiredArgsConstructor
@Component
public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

    private final RedirectStrategy redirectStrategy;


    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
        // We do some stuff here...
        log.debug("Redirecting to /profile");
        log.debug("request.getScheme() = " + request.getScheme());
        log.debug("request.getContextPath() = " + request.getContextPath());
        log.debug("request.getRequestURI() = " + request.getRequestURI());
        log.debug("request.getRequestURL() = " + request.getRequestURL().toString());
        log.debug("request.getServletPath() = " + request.getServletPath());
        redirectStrategy.sendRedirect(request, response, "/profile");
    }

}

With the Spring Boot version 2.0.x, no problem, everything was working fine. After the migration to Spring Boot version 2.3.x, the user was redirect to http://INTERNAL_OPENSHIFT_HOST/ourApp/profile

I found the "new" parameter introduced since Spring Boot 2.2 called server.forward-headers-strategy. If I set the value to "framework", then the redirect is done to http://REVERSE_PROXY_HOST/ourApp/profile

And well... I have no idea why http is used instead of https! I suppose everything is correctly setup on the reverse-proxy side because well everything was fine with Spring Boot 2.0.x!

I probably miss something... another parameter of something similar but I'm currently stuck on that point... Any idea?

1 Answers
Related