title: Tomcat behind Apache: Using SSL with j_security_check
body: <p>I have a little problem with using SSL on a Tomcat that is behind Apache. I have used Google all morning to try to find a good solution, but nothing so far.</p>
  
  <p>As a part of my SSL VirtualHost configuration I have</p>
  
  <pre><code>&lt;Location /MyApp/&gt;
    ProxyPass http://localhost:8080/MyApp/
  &lt;/Location&gt;
  </code></pre>
  
  <p>This works fine for most cases, but j_security_check, after a successful login from <a href="https://mysite.com/MyApp" rel="nofollow noreferrer">https://mysite.com/MyApp</a>, redirects to a HTTP page <a href="http://mysite.com/MyApp/secret.html" rel="nofollow noreferrer">http://mysite.com/MyApp/secret.html</a> instead of leaving it as a HTTPS page <a href="https://mysite.com/MyApp/secret.html" rel="nofollow noreferrer">https://mysite.com/MyApp/secret.html</a>. It's not only the login that's confidential, but the data that is being transmitted, so I need to keep it HTTPS. When I add to the application's security-contraints</p>
  
  <pre><code>&lt;user-data-constraint&gt;
    &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
  &lt;/user-data-constraint&gt;
  </code></pre>
  
  <p>it redirects to <a href="https://mysite.com:8443/MyApp/secret.html" rel="nofollow noreferrer">https://mysite.com:8443/MyApp/secret.html</a>. I realize that it redirects to 8443 because server.xml has SSL configured to 8443, but since this is proxied through Apache, it should in fact be 443.</p>
  
  <p>I realize I have no ProxyPassReverse, but that's not something I can add within a  section of the Apache config file</p>
  
  <p>How can I force j_security_check to either redirect relative (so not change https to http) or to redirect to 443 instead of 8443? Is this something I should enforce via Tomcat or Apache's mod_proxy?</p>
  
  <p>Cheers</p>
  
  <p>Nik</p>