Cannot stop Spring redirecting https to http

Question

I'm developing project on a Spring Security and everything was going fine until I loaded my project to a production server. I have only http on my local machine but there is https on a production server.

And I faced an error (in case of login error):

Mixed Content: The page at 'https://my.production.com/login' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://my.production.com/api/login?error=bad-credentials'. This request has been blocked; the content must be served over HTTPS.

and (in case of success login):

Mixed Content: The page at 'https://my.production.com/login' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://my.production.com/authorities'. This request has been blocked; the content must be served over HTTPS.

I asked my vendor about this issue but they say that " There is no https between you app and nginx, so this is your app problem "...

I tried this , but this solution looks very weird and doesn't solve problem (It requires adding a lot of configuration classes and I guess it shouldn't be so hard). Actually I'm very confused how can this happen, why isn't it the default behavior to redirect to the schema that the request was made...

Also I tried adding this to my Spring Security config:

 .and().requiresChannel().anyRequest().requiresSecure()

but this only causes ERR_TOO_MANY_REDIRECTS on my local machine and on a production server...

This didn't help too:

http.portMapper()
                .http(8080).mapsTo(8443);

I'm not using Spring boot, but also tried this , no help.

Success authentication configuration looks like this:

SavedRequestAwareAuthenticationSuccessHandler successHandler = new
                SavedRequestAwareAuthenticationSuccessHandler();
        successHandler.setDefaultTargetUrl(env.getProperty("app.authenticationSuccessUrl"));

Answer 1

When Apache Tomcat is running behind a HTTPS (reverse) proxy, there may be some configuration required for links and redirects to work properly.

Open conf/ server.xml , find the Connector element, add the following attributes if not already present:

• proxyName - set to your domain name.
• proxyPort - set it to 443 if you are using the standard https port.
• scheme - set to "https" if site is accessed with https.
• secure - set to "true" for https.

<Connector proxyName="my.production.com" proxyPort="443" scheme="https" secure="true" ...>

Reference: Apache Tomcat 7: The HTTP Connector