Offloading https to load balancers with Spring Security

Question

Right now, the load balancers handle https and then pass along that https to my web servers. So dealing with https double for each request. What I want to do is completely offload https so my web servers don't have to deal with it.

How do I configure Spring Security and JSP pages given that the web servers think all requests are http? Obviously I'll have to modify the <intercept-url> elements of my configuration to have their requires-channel attribute always be http or any. In my JSP pages I'll have to prepend the <c:url value=''/> links with a ${secureUrl} and ${nonSecureUrl} depending whether the resulting page needs to be https or http. Redirects from controllers need to be modified like this as well... Anything else?

Seems like quite a pain to modify all links in JSP pages to include the scheme and host too. Is there a better way to do that?

Answer 1

If you terminate SSL at the load balancer then your load balancer should send a header indicating what protocol was originally requested. For example, the F5 adds X-Forwarded-Proto.

From here you can create custom ChannelProcessors that look at this header instead of looking at request.isSecure(). Then you can continue using <intercept-url requires-channel="https"> and relative <c:url>.

The steps:

1. Subclass SecureChannelProcessor and InsecureChannelProcessor overriding decide(). In decide() check the header sent by your load balancer.

   @Override
   public void decide(FilterInvocation invocation, Collection<ConfigAttribute> config) throws IOException, ServletException {
   
     for (ConfigAttribute attribute : config) {
         if (supports(attribute)) {
             if (invocation.getHttpRequest().
                     getHeader("X-Forwarded-Proto").equals("http")) {
                 entryPoint.commence(invocation.getRequest(),
                     invocation.getResponse());
             }
         }
     }
   }
   

2. Then set these ChannelProcessors on the ChannelDecisionManagerImpl bean using a BeanPostProcessor. See this Spring Security FAQ on why/how to use a BeanPostProcessor for this.