Disable spring security https redirecting

Question

I am working on a web application and configured ssl certificate to run on https in Tomcat.

<Connector port="8080" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true" clientAuth="false" keystoreFile="conf/expchannel.pfx" keystorePass="***" keystoreType="PKCS12">

For some reasons, client wants to run it on 8080 port. Should not matter.

The problem is with Spring security login interceptor. Once it gets the request, it automatically redirects to login page, but for unknown reason it uses 8443 port, which will never be served (ends with timeout)

Configuration:

<security:http auto-config="true" use-expressions="true">   
    <security:csrf disabled="true"/>
    <!-- Other pages only autenticated  -->
    <security:intercept-url pattern="/pages/userManagement.xhtml" access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/pages/performanceMonitoring.xhtml" access="hasRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/pages/**" access="hasRole('ROLE_USER')" />

    <security:session-management invalid-session-url="/sessionExpired.xhtml">
    </security:session-management>

    <!-- Set the login page and what to do if login fails -->
    <security:form-login login-page="/login.xhtml" authentication-failure-url="/loginFail.xhtml" 
        default-target-url="/pages/statusOverview.xhtml" />
    <security:csrf/>
</security:http>

The other application instance, running on 7080 port does not have this problem, I guess there is some kind of hidden default behavior to change port exactly from 8080 -> 8443 in case of https request.

Is there a way to disable this behavior? I was looking for the answer but I didnt found any. The only solution I found was setting http and https ports explicitly in spring configuration which doesnt seem right to me. I want it configurable on tomcat config, not individually for each web application.

Thanks for any help.

Answer 1

You need to set secure="true" on that connector along with scheme="https" .

Note that using port 8080 for secure-HTTP is like using port 80 for plaintext HTTP: surprising .

The value 8443 is coming from Tomcat's default redirectPort setting on the connector: Tomcat (or possibly Spring) is redirecting the user to what it thinks is the "secure" connector because all logins should be performed over TLS.