title: How to Reproduce sendRedirect issue - HTTPS change to HTTP
body: <p>I am using response.sendRedirect() to redirect the user to Home page, once the user gets authenticated successfully. This is to avoid the "Login redirect vulnerability".</p>
  
  <p>However, because of above change, One of my customer is facing issue where his HTTPS request are getting converted to HTTP (with ip address in the URL). The reason for the same is explained here</p>
  
  <p><a href="http://geekexplains.blogspot.in/2008/06/https-becoming-http-in-case-of.html" rel="nofollow">http://geekexplains.blogspot.in/2008/06/https-becoming-http-in-case-of.html</a></p>
  
  <p>Now, How can i reproduce the issue (or setup the environment) so that I can verify my fix. I thought I could reproduce by setting up Apache server infront of tomcat but I am not able to reproduce above mentioned issue.</p>
  
  <p>In Apache httpd.conf i have below entries</p>
  
  <pre><code>ProxyPass /myconsole ajp://localhost:8009/myconsole
  ProxyPassReverse /myconsole ajp://localhost:8009/myconsole
  </code></pre>
  
  <p>Accessed the application like,</p>
  
  <pre><code>http://myapacheserver/myconsole/Login.jsp
  </code></pre>
  
  <p>After the successful login, I am getting redirected to </p>
  
  <pre><code>http://myapacheserver/myconsole/Home.jsp
  </code></pre>
  
  <p>I am expecting to redirect to the IP address. something like <code>http://10.32.24.14:8080/myconsole/Home.jsp</code>.</p>
  
  <p>In the customer environment he is getting redirected to the ip address of App server (tomcat).</p>
  
  <p>Any pointer would be helpful.</p>
  
  <p>Thanks</p>
  
  <p>Note: 
  For those interested, I am building the full URL by getting the first part of URI from the configuration file.</p>
  
  <pre><code>//Get the LB URI part. Eg: https://dev.loadbalancer.com/
  String loadBalancerURI = getConfig().getLoadBalancerRequestURI();
  String redirectURL = request.getContextPath() + "/Home.jsp";
  
  //Prepend the LoadBalancer URI with redirect URI
  if(loadBalancerURI != null)
  {
      redirectURL = loadBalancerURI + "/" + redirectURL;  
  }
  
  //redirect to home page
  response.sendRedirect(redirectURL);
  
  return;
  </code></pre>
  
  <p><strong>Edit:</strong> More info on the setup. The customer has F5 load balancer where the SSL traffic stops and then there is a Apache Reverse Proxy servers which proxy to pool of tomcat servers. The issue is when we do redirect the redirect URL is for Tomcat Servers. What we are expecting is to have the load balancer URL in the redirect URL. </p>
  
  <p>Is it possible to do some change in the Apache server which will rewrite the URL in the HTTP header in the response send by Tomcat?</p>