title: Spring security login over ssl on port 8443 not recognized on port 8080 with http protocol
body: <p>I'm experiencing a strange behaviour trying to secure my login form.</p>
  
  <p>My app is developed over Spring Framework and Spring Security and deployed on a Tomcat server.
  Everything works fine using only http, but when I use https 8443 port for my login page, after a successfull login and a redirect lo <a href="http://localhost:8080/mens/index" rel="nofollow">http://localhost:8080/mens/index</a> I get redirected to login page at <a href="https://localhost:8443/mens/login.html" rel="nofollow">https://localhost:8443/mens/login.html</a></p>
  
  <p>This is (part of) the configuration of my spring-security.xml:</p>
  
  <pre><code>&lt;!-- enable use-expressions --&gt;
  &lt;http auto-config="true" use-expressions="true"&gt;
      &lt;custom-filter position="SWITCH_USER_FILTER" ref="switchUserProcessingFilter" /&gt;
      &lt;intercept-url pattern="/j_spring_security_switch_user" access="hasRole('ROLE_SUPERVISOR')"/&gt;
  
      &lt;session-management invalid-session-url="/login.html?invalidSession=1" session-fixation-protection="newSession"&gt;
          &lt;concurrency-control max-sessions="10" error-if-maximum-exceeded="true"/&gt;
      &lt;/session-management&gt;
  
      &lt;intercept-url pattern="/login.html" access="hasRole('ROLE_ANONYMOUS')" requires-channel="https"/&gt;
      &lt;intercept-url pattern="/resources/**" access="permitAll" requires-channel="any"/&gt;
      &lt;intercept-url pattern="/admin**" access="hasRole('ROLE_ADMIN')" requires-channel="http"/&gt;
      &lt;intercept-url pattern="/rest/**" access="hasRole('ROLE_USER')" requires-channel="http"/&gt;
      &lt;intercept-url pattern="/index" access="hasRole('ROLE_USER')" requires-channel="http"/&gt;
      &lt;intercept-url pattern="/upload/**" access="hasRole('ROLE_USER')" requires-channel="http"/&gt;
  
      &lt;headers&gt;
          &lt;xss-protection block="false"/&gt;
          &lt;frame-options disabled="true"/&gt;
          &lt;cache-control/&gt;
      &lt;/headers&gt;
  
      &lt;!-- access denied page --&gt;
      &lt;access-denied-handler error-page="/403" /&gt;
      &lt;form-login 
          login-page="/login.html" 
          default-target-url="/index" 
          always-use-default-target="true"
          authentication-failure-url="/login.html?error=1" 
          username-parameter="username" 
          password-parameter="password"/&gt;
      &lt;logout logout-success-url="/login.html?logout=1" invalidate-session="false" delete-cookies="JSESSIONID"/&gt;
      &lt;!-- enable csrf protection --&gt;
      &lt;!-- &lt;csrf disabled="true" /&gt; --&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>Alternatively, I tried to use a channelProcessingFilter instead of the requires-channel attribute:</p>
  
  <pre><code>&lt;http auto-config="true" use-expressions="true"&gt;
      &lt;custom-filter position="CHANNEL_FILTER" ref="channelProcessingFilter"/&gt;
  
      &lt;custom-filter position="SWITCH_USER_FILTER" ref="switchUserProcessingFilter" /&gt;
      &lt;intercept-url pattern="/j_spring_security_switch_user" access="hasRole('ROLE_SUPERVISOR')"/&gt;
  
      &lt;session-management invalid-session-url="/login.html?invalidSession=1" session-fixation-protection="newSession"&gt;
          &lt;concurrency-control max-sessions="10" error-if-maximum-exceeded="true"/&gt;
      &lt;/session-management&gt;
  
      &lt;intercept-url pattern="/login.html" access="hasRole('ROLE_ANONYMOUS')"/&gt;
      &lt;intercept-url pattern="/resources/**" access="permitAll"/&gt;
      &lt;intercept-url pattern="/admin**" access="hasRole('ROLE_ADMIN')"/&gt;
      &lt;intercept-url pattern="/rest/**" access="hasRole('ROLE_USER')"/&gt;
      &lt;intercept-url pattern="/index" access="hasRole('ROLE_USER')"/&gt;
      &lt;intercept-url pattern="/upload/**" access="hasRole('ROLE_USER')"/&gt;
  
      &lt;headers&gt;
          &lt;xss-protection block="false"/&gt;
          &lt;frame-options disabled="true"/&gt;
          &lt;cache-control/&gt;
      &lt;/headers&gt;
  
      &lt;!-- access denied page --&gt;
      &lt;access-denied-handler error-page="/403" /&gt;
      &lt;form-login 
          login-page="/login.html" 
          default-target-url="/index" 
          always-use-default-target="true"
          authentication-failure-url="/login.html?error=1" 
          username-parameter="username" 
          password-parameter="password"/&gt;
      &lt;logout logout-success-url="/login.html?logout=1" invalidate-session="false" delete-cookies="JSESSIONID"/&gt;
      &lt;!-- enable csrf protection --&gt;
      &lt;!-- &lt;csrf disabled="true" /&gt; --&gt;
  &lt;/http&gt;
  
  &lt;beans:bean id="channelProcessingFilter" class="org.springframework.security.web.access.channel.ChannelProcessingFilter"&gt;
      &lt;beans:property name="channelDecisionManager" ref="channelDecisionManager"/&gt;
      &lt;beans:property name="securityMetadataSource"&gt;
          &lt;filter-security-metadata-source request-matcher="regex"&gt;
              &lt;intercept-url pattern="\A/login.*\Z" access="REQUIRES_SECURE_CHANNEL"/&gt;
              &lt;intercept-url pattern="\A/login.html.*\Z" access="REQUIRES_SECURE_CHANNEL"/&gt;
              &lt;intercept-url pattern="\A/.*\Z" access="ANY_CHANNEL"/&gt;
          &lt;/filter-security-metadata-source&gt;
      &lt;/beans:property&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="channelDecisionManager" class="org.springframework.security.web.access.channel.ChannelDecisionManagerImpl"&gt;
      &lt;beans:property name="channelProcessors"&gt;
          &lt;beans:list&gt;
              &lt;beans:ref bean="secureChannelProcessor"/&gt;
              &lt;beans:ref bean="insecureChannelProcessor"/&gt;
              &lt;beans:ref bean="anyChannelProcessor"/&gt;
          &lt;/beans:list&gt;
      &lt;/beans:property&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="secureChannelProcessor" class="com.mycompany.mens.springsecurity.MensSecureChannelProcessor"/&gt;
  &lt;beans:bean id="insecureChannelProcessor" class="com.mycompany.mens.springsecurity.MensInsecureChannelProcessor"/&gt;
  &lt;beans:bean id="anyChannelProcessor" class="com.mycompany.mens.springsecurity.MensAnyChannelProcessor"&gt;
      &lt;beans:property name="entryPoint" ref="mensRetryWithHttpEntryPoint"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean name="mensRetryWithHttpEntryPoint" class="com.mycompany.mens.springsecurity.MensRetryWithHttpEntryPoint"/&gt;
  </code></pre>
  
  <p>Debugging I found that authentication is successfull, entry point redirects the flow to index page on http port 8080, but after that something is redirecting me to login form another time.</p>
  
  <p>Any suggestion?</p>
  
  <p>Thank you very much in advance, I really appreciate your help!</p>