spring security 登录成功期间强制Https连接

Question

I have one spring boot app which contains spring security with formLogin being added and custom loginPage . Whenever I get authenticated then it will send me to the defaultSuccessUrl which is /app/dashboard and it sends with the schema http I been trying all day to just make the successUrl schema to be https just tweaking some changes on application.properties and sometimes with Bean but i am still not able to make it happen. My application is in cloudfoundry which and i don't have 80 port but only 443(https) .

My configuration in spring is like this :

http
    .authorizeRequests()
    .antMatchers("/", "/forbidden", "/index.html", "/webjars/*", "/app.js", "/access/*", "/signup", "/l10n/*.js", "/", "/tpl/**/*.html", "/fonts/**/*.woff").permitAll()
    .anyRequest().authenticated()

    .and().addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class).
    csrf().csrfTokenRepository(repo)

    .and() .httpBasic().disable()
    .formLogin()
    .loginPage("/access/signin").permitAll()
    .failureUrl("/error")
    .defaultSuccessUrl("/app/dashboard")
    .and().logout()
    .logoutRequestMatcher(new AntPathRequestMatcher("access/logout"))
    .logoutSuccessUrl("/access/signin").permitAll();

I did also tried to use absolute url with https but it is not working good.

Answer 1

你有没有尝试requiresChannel()和requiresSecure()？对于可以通过 https 访问的特定 url，您可以尝试

.defaultSuccessUrl("/app/dashboard").and().requiresChannel().antMatchers("/app/dashboard").requiresSecure() 

对于通过 https 的所有请求，您可以使用 like

.and().requiresChannel().anyRequest().requiresSecure()

您可以使用如下所示的端口映射。

 http
     .portMapper()              
        .http(8080).mapsTo(443);

请参阅this和this了解更多详情。