I have a Spring web app, secured with Spring Security, running on EC2. In front of the EC2 instance is an Elastic Load Balancer with an SSL cert (https terminates at the load balancer ie. port 443 -> port 80), so from Tomcat's perspective, inbound requests are HTTP.
My login form submits to https, however the subsequent redirect goes to http (success or fail). The authentication was successful, and I can go back to https and I'm logged in.
My login configuration looks like so:
<security:form-login default-target-url="/home" login-page="/" login-processing-url="/processlogin" authentication-failure-url="/?login_error=1"/>What do I need to change to make default-target-url and authentication-failure-url go to https?
- Tomcat 6
- Spring Security 3.0.x