CODEWITHSUNDEEP
grailssslhttpsspring-securityjelastic
user723858
user723858

Reputation: 1017

Grails Spring Security secureChannel not redirecting https?

I currently have an application I am working on that I am using in the cloud (Jelastic). I have added SSL certs to my Cloud environment and want to be able o now use https on certain pages. I have implemented the below methods of doing this:

Method 1:

grails.plugins.springsecurity.secureChannel.definition = [
   '/login/**':         'REQUIRES_SECURE_CHANNEL'
]

Method 2:

grails.plugins.springsecurity.secureChannel.definition = [
   '/login/**':         'REQUIRES_SECURE_CHANNEL'
]

grails.plugins.springsecurity.secureChannel.useHeaderCheckChannelSecurity = true
grails.plugins.springsecurity.secureChannel.secureHeaderName = 'X-Forwarded-Proto'
grails.plugins.springsecurity.secureChannel.secureHeaderValue = 'http'
grails.plugins.springsecurity.secureChannel.insecureHeaderName = 'X-Forwarded-Proto'
grails.plugins.springsecurity.secureChannel.insecureHeaderValue = 'https'

So for method 1 it partly works as when you go to the index page in HTTP and then try to go to the login page you will be shown an error message saying:

Firefox has detected that the server is redirecting the request for this address in a way that will never complete.

Method 2 however does not seem to work at all and when I go to the Login page on HTTP it does not redirect me as I would expect and just seems to work on HTTP which is strange.

This solution is hosted in Jelastic as I mention so not sure is that could be causing some issues, but any help offered would be great.

Thanks in advance

Upvotes: 4

Views: 1657

Answers (1)

user3877963
user3877963

Reputation: 348

I used the following config for deploying on to prod server. Then it started on https. I am using jdk 1.8 and Tomcat 8.

grails.plugin.springsecurity.portMapper.httpPort = 80
grails.plugin.springsecurity.portMapper.httpsPort = 443
grails.plugin.springsecurity.secureChannel.secureHeaderName = 'X-FORWARDED-PROTO'
grails.plugin.springsecurity.secureChannel.secureHeaderValue = 'http'
grails.plugin.springsecurity.secureChannel.insecureHeaderName = 'X-FORWARDED-PROTO'
grails.plugin.springsecurity.secureChannel.insecureHeaderValue = 'https'
grails.plugin.springsecurity.auth.forceHttps = true
grails.plugin.springsecurity.secureChannel.definition = [
        '/**':               'REQUIRES_SECURE_CHANNEL'
]

Upvotes: 3

Related Questions