title: Spring Security OAuth2 Behind a Proxy Server
body: <p>There seem to be many examples of Spring Security OAuth2, but most of them run on localhost at some specific set of ports. I was able to get my application working with ports specified for my AuthorizationServer and my ResourceServer. The next step I needed to take was move this application behind a proxy server, but the application stopped functioning. The main issues seem to be path related, but I'm struggling with lack of examples on how to accomplish the task of moving OAuth2 Spring behind a proxy server. I've focused on overriding the WhitelabelApprovalEndpoint, but I'm not sure if this is what is required.</p>
  
  <p>I was able to create a controller that is nearly identical to the WhiteLabelApprovalEndpoint, but do not know how to adapt it to accommodate being behind a proxy.</p>
  
  <pre><code>@Controller
  @SessionAttributes("authorizationRequest")
  public class ApprovalEndpoint {
  
      @RequestMapping("/oauth/confirm_access")
      ...
          private static String TEMPLATE = "&lt;html&gt;&lt;body&gt;&lt;h1&gt;OAuth Approval&lt;/h1&gt;"
          + "&lt;p&gt;Do you authorize '${authorizationRequest.clientId}' to access your protected resources?&lt;/p&gt;"
          + "&lt;form id='confirmationForm' name='confirmationForm' action='authorize' method='post'&gt;&lt;input name='user_oauth_approval' value='true' type='hidden'/&gt;%csrf%%scopes%&lt;label&gt;&lt;input name='authorize' value='Authorize' type='submit'/&gt;&lt;/label&gt;&lt;/form&gt;"
          + "%denial%&lt;/body&gt;&lt;/html&gt;";
      ...
  </code></pre>
  
  <p>The only change I made to the class was to update the form action string, making the path relative by replacing</p>
  
  <pre><code>action='${path}/oauth/authorize'
  </code></pre>
  
  <p>with</p>
  
  <pre><code>action='authorize'
  </code></pre>
  
  <p>This allows the POST to go to the correct URL</p>
  
  <pre><code>http://localhost/proxy/stuff/javaPath/oauth/authorize
  </code></pre>
  
  <p>instead of</p>
  
  <pre><code>http://javaPath/oauth/authorize
  </code></pre>
  
  <p>The latter doesn't map when submitted through Apache (the frontend proxy). But it would seem that this creates other problems in the Java application, because this results in the error</p>
  
  <pre><code>error="invalid_request", error_description="Cannot approve uninitialized authorization request."
  </code></pre>
  
  <p>I see that this exception is thrown in the AuthorizationEndpoint when the authorizationRequest is null. This looks like it should be handled by my custom class having SessionAttributes set properly, but updating the just the path that I'm POSTing to seems to break this.</p>