HTTPS, Tomcat and Load Balancers.. Oh My!
Wednesday, August 22nd, 2007During the implementation of a new servlet application on Tomcat we encountered an HTTP/HTTPS issue during redirects. The user would browse to a servlet via HTTPS, through a load balancer that handled SSL decryption, and during the execution of the servlet, they would be redirected to another URL. However, that redirect would be generated as a fully qualified HTTP address. This poses a problem. The page was originally requested as secure content, and the user is redirected to an insecure URL. Ultimately, the user sees a security warning. We figured it out by using the Tamper Data Firefox extension.
(more…)