Spring Security and AJP Proxy

Question

I am using Spring Protection and the Apache proxy for the web application. When using the standard mod_proxy, everything is fine, but after switching to AJP proxies, there is a problem with spring security redirection.

Apache configuration:

<VirtualHost *:80> ServerName domain.com ProxyPass / ajp://localhost:8009/Context/ ProxyPassReverse / ajp://localhost:8009/Context/ </VirtualHost> 

When I call http://domain.com/login , I see the login form.

When I submit the form, I go to http://domain.com/auth and get authentication.

Then Spring Security should be redirected to http://domain.com/index , but instead redirected to http://domain.com/Context/index

How can I get rid of this path? Why does Spring Security add it everywhere?

There was a similar question on the Spring Security site, but no one answered:

http://forum.springsource.org/showthread.php?95141-Why-is-spring-security-including-the-context-path

PS It seems strange that Google does not find anything more related to this problem. Am I the only one using Spring Security + AJP? Maybe this is the wrong template?

Decision:

 <VirtualHost *:80> ServerName domain.com RewriteEngine on RewriteRule ^/Context/(.*)$ /$1 [R=301] ProxyPass / ajp://localhost:8009/Context/ ProxyPassReverse / ajp://localhost:8009/Context/ </VirtualHost> 

Answer 1

Spring Security is a web application context, meaning that its redirects will always be based on the current context of the web application. This is by design, since your application server can work with several separate web applications that should not interfere with each other.

Do you run only this application on your server and have the ability to deploy it as a ROOT application on Tomcat (for example, paste it into webapps/ROOT/ )? This will eliminate your context prefix and solve your problem.

Another option would be to rewrite the redirect URL on the application server before sending it to the client, for example. d. with a outbound-rule from org.tuckey great URLRewriteFilter (e.g. mod_rewrite, but for Java EE web applications). Of course, you will need to take care of the correct filtering order in web.xml , since Spring Security also uses filters for its logic.