Setting up SSL/HTTPS - Hybris (TC) / Apache / Spring Security

[Former Member]

Is there a recommended approach or an example config for configuring SSL (with Apache as a proxy for Tomcat - port 80 and 443)?

We had a problem reaching HTTPS-pages , we'd get an infinite redirect loop when trying to reach the login/register page.

To 'solve' this, we have set all security-intercept rules in our storefront spring-security.xml to HTTP and let Apache take care of enforcing the SSL-encryption. As a consequence, some functionality in the storefront doesn't work anymore such as setting a GUID cookie etc., some methods check if the request is secure ( by calling request.isSecure() ). Since the require-channel is set to HTTP, hybris thinks the requests are insecure, but in reality they are secure. Removing these request.isSecure() checks does the trick, but this entire approach feels hacky and I'd like to do this the right way...

Thanks for your advice on this!

[Former Member]

This has been covered many times on the Forum. Shame this site doesn't include any of that info. From three years ago.

How is your Apache marking the channel as secure? One assumes it will add a HTTP Header to requests, which is fairly standard. Then you need a ChannelProcessor to pick this up.

[Former Member]

BTW this is the correct approach. Using RemoteIPValve is a hack around this using something designed to solve a different problem.

[Former Member]

Can you perhaps explain how this would work? I should use a ChannelProcessor (in a beforeController interceptor I presume) to extract the X-Forwarded-Proto header, to see if 'https' is present, correct? Then, I somehow manually set the isSecure() field on the HttpServletRequest to true?