Spring安全性更改重定向URL以使用HTTPS而不是HTTP

Question

I'm working with a Spring microservice protected with Spring Security SSO login (Using Cloudfoundry UAA).

Microservice when deployed on Cloud is accessible via HTTPS URL. Since HTTPS URL is of the ELB (Load balancer/web server), actual request to microservice from ELB comes on HTTP . So Spring when redirecting the user to login page produces HTTP URL instead of HTTPS URL in 302 Location header.

Following is the flow

Browser
    ->(https://mymicroservice.com) Unauthenticated request (Load balancer)
        ->(http://internal_lan_ip:someport) Microservice
            -> 302 Location http://mymicroservice.com/login
                -> Browser http://mymicroservice.com/login (failed)

In short it goes from HTTPS -> HTTP -> 302 HTTP (failed as ELB doesn't serve on HTTP)

Following is what I have tried

x-forwarded-proto

Since load balancer is also not populating x-forwarded-proto correctly to HTTPS , instead it gives me HTTP , I can't use Spring's support for it.

Require channel HTTPS

It also doesn't work, as it results in infinite redirections from Spring as Spring never receives an HTTPS request from ELB , despite correctly having produced HTTPS redirect URL.

Interceptor/Filter

Use a ServletFilter to check response header Location and if present replace http:// with https:// .

Frankly last option is my final option as I do not control the ELB configuration.

Now issue is that I'm unable to intercept the response after spring redirects to /login URL which in turn should redirect to SSO URL.

I have tried various combinations of Interceptors (postHandle, afterCompletion), using Spring security to inject it at various locations in the filter chain and finally setting the filter order to lowest. None of these intercept unauthenticated request after redirection.

@Component
@Order(Ordered.LOWEST_PRECEDENCE)
class RedirectUrlProtocolUpdaterFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        String locationHeader = response.getHeader("Location");
        System.out.println("############ inside interceptor");

        for(String name: response.getHeaderNames()) {
            System.out.println(name + " : " + response.getHeader(name));
        }

        if(locationHeader != null && locationHeader.startsWith("http://")) {
            System.out.println("###################### setting location header");

            locationHeader = locationHeader.replaceAll("http://", "https://");
            response.setHeader("Location", locationHeader);
        }

        filterChain.doFilter(request, response);

    }
}

How do I correctly intercept the /login redirection by Spring Security in a filter/interceptor and update Location header to include correct protocol?

Any hint is appreciated.

Answer 1

If you want to update Location header info you can try to use an HttpResponseInterceptor.

This is an example of use from google HttpResponseInterceptor: https://developers.google.com/api-client-library/java/google-http-java-client/reference/1.20.0/com/google/api/client/http/HttpResponseInterceptor

Other option is from Apache: https://hc.apache.org/httpcomponents-core-ga/httpcore/apidocs/org/apache/http/class-use/HttpResponseInterceptor.html

Answer 2

SpringFramework provides the HandlerInterceptor. This will intercept all http request, but can be used to constantly check for authentication and authorization. You will have to provide implementations for 3 methods (if you don't use them just implement an empty method). You can then put your code in the preHandle method.

public class AuthenticationInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o) throws Exception {
    }

    @Override
    public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {
    }

    @Override
    public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {
    }
}