title: Require HTTPS with Spring Security behind a reverse proxy
body: <p>I have a Spring MVC application secured with Spring Security. The majority of the application uses simple HTTP to save resources, but a small part processes more confidential information and requires an HTTPS channel.</p>
  
  <p>Extract from the <code>security-config.xml</code> :</p>
  
  <pre><code>&lt;sec:http authentication-manager-ref="authenticationManager" ... &gt;
      ...
      &lt;sec:intercept-url pattern="/sec/**" requires-channel="https"/&gt;
      &lt;sec:intercept-url pattern="/**" requires-channel="http"/&gt;
  &lt;/sec:http&gt;
  </code></pre>
  
  <p>All worked fine until we decided to migrate it to the main server, where the application servers run behind reverse proxies. And as now HTTPS is processed by the reverse proxies the application server only sees HTTP requests, and disallows access to the <code>/sec/**</code> hierarchy.</p>
  
  <p>After some research, I found that the proxies add a <code>X-Forwarded-Proto: https</code> header <sup>(*)</sup>, but in Spring Security <em><code>HttpServletRequest.isSecure()</code> is used to determine the channel security offered</em> (extract from <code>SecureChannelProcessor</code> javadoc).</p>
  
  <p>How can I tell Spring Security that a <code>X-Forwarded-Proto: https</code> header is enough for a secure request?</p>
  
  <p>I know I could report that part on proxies configuration, but the proxies administrator really does not like that solution, because there are many application behind the proxies and the configuration could grow to a non manageable state.</p>
  
  <p>I an currently using Spring Security 3.2 with XML config, but I'm ready to accept answers based on Java config and/or more recent version.</p>
  
  <p><sup>(*)</sup> <em>Of course, the proxies remove the header if it was present in incoming request, so the application can be confident in it.</em></p>