title: Spring security ajax login use http redirect instead of https
body: <p>I just migrate my webapp to HTTPS and everything works fine except ajax login.(although non ajax login works)</p>
  
  <p>When I try to log in, I get the following error message : </p>
  
  <pre><code>Mixed Content: The page at 'https://www.foo.bar/paris' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://www.foo.bar/security/ajax-success'. This request has been blocked; the content must be served over HTTPS.
  </code></pre>
  
  <p>and in the network tab I get</p>
  
  <pre><code>https://www.foo.bar/security/ajax-login     status - &gt; canceled
  http://www.foo.bar/security/ajax-success    status -&gt; blocked(mixed-content)
  </code></pre>
  
  <p>I use apache2 and tomcat with ProxyPass
  here is my default-ssl config : </p>
  
  <pre><code>&lt;VirtualHost _default_:443&gt;
      ServerAdmin contact@foo.bar
      ServerName www.foo.bar
      ErrorLog /home/apache_logs/error_website.log
      CustomLog /home/apache_logs/access_website.log combined
      SSLEngine on
      SSLCertificateFile /home/sslcerts/certs/www.foo.bar.crt
      SSLCertificateKeyFile /home/sslcerts/private/foo.key
      SSLCertificateChainFile /home/sslcerts/certs/foo.pem
      SSLVerifyClient None
      ProxyRequests Off
      ProxyPreserveHost On
      ProxyPass / http://0.0.0.0:8080/
      ProxyPassReverse / https://0.0.0.0:8080/
  &lt;/VirtualHost&gt;
  
  &lt;VirtualHost *:80&gt;
      ServerName www.foo.bar
      ServerAlias foo.bar
      Redirect "/" "https://www.foo.bar/"
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>I use Spring security in this java web app, here is my config file : </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(securedEnabled = true)
  public class MultiHttpSecurityConfig {
  @Autowired
  @Qualifier("userDetailsService")
  UserDetailsService userDetailsService;
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
  }
  
  @Bean
  public PasswordEncoder passwordEncoder() {
      return new BCryptPasswordEncoder();
  }
  
  @Configuration
  @Order(1)
  public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .csrf().disable()
                  .antMatcher("/security/**")
                  .authorizeRequests()
                  .anyRequest().authenticated()
                  .and()
                  .formLogin()
                  .loginProcessingUrl("/security/ajax-login")
                  .loginPage("/security/ajax-login-page")
                  .failureUrl("/ajax-failure")
                  .defaultSuccessUrl("/security/ajax-success", true)
                  .and()
                  .logout()
                  .invalidateHttpSession(true)
                  .deleteCookies("hdfyer")
                  .logoutRequestMatcher(new AntPathRequestMatcher("/app/logout"));
      }
  }
  
  @Configuration
  public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
      @Override
      public void configure(WebSecurity web) throws Exception {
          web
                  .ignoring()
                  .antMatchers("/resources/**")
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .csrf().disable()
                  .authorizeRequests()
               .antMatchers("/account").access("hasRole('ROLE_USER')")
                  .and()
                  .formLogin()
                  .loginPage("/login")
                  .failureUrl("/login?error")
                  .loginProcessingUrl("/j_spring_security_check")
                  .usernameParameter("username")
                  .passwordParameter("password")
                  .successHandler(new AuthenticationSuccessCallback())
                  .and()
                  .logout()
                  .invalidateHttpSession(true)
                  .deleteCookies("jforumUserInfo")
                  .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
      }
  
      @Bean(name = "myAuthenticationManager")
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  }
  }
  </code></pre>
  
  <p>I tried to add requiresChannel or portMapper without success (it sometimes fail with a too many redirect error though...).</p>
  
  <p>I fail too see what is wrong with these configuration.
  How can I make spring security redirects ajax login success on https instead of http ?</p>