title: Pentaho j_spring_security_check mixed content. HTTPS to HTTP
body: <p>I have installed Pentaho (9.x) on Tomcat 8.5 and OpenJDK 1.8 as required.
  In front of it there is Apache 2.4 with mod_proxy_http.</p>
  <p>My website is served with HTTPS and I have these Proxy rules:</p>
  <pre><code>    RequestHeader set X-Forwarded-Proto &quot;https&quot;
      ProxyPreserveHost on
  
      ProxyPass &quot;/pentaho&quot;  &quot;http://tomcat_host_ip:8080/pentaho&quot;
      ProxyPassReverse &quot;/pentaho&quot;  &quot;http://tomcat_host_ip:8080/pentaho&quot;
  
      ProxyPass &quot;/pentaho/&quot;  &quot;http://tomcat_host_ip:8080/pentaho/&quot;
      ProxyPassReverse &quot;/pentaho/&quot;  &quot;http://tomcat_host_ip:8080/pentaho/&quot;
  
      ProxyPass &quot;/pentaho/Login&quot;  &quot;http://tomcat_host_ip:8080/pentaho/Login&quot;
      ProxyPassReverse &quot;/pentaho/Login&quot;  &quot;http://tomcat_host_ip:8080/pentaho/Login&quot;
  </code></pre>
  <p>When I try to log in a get an error during the POST:
  <a href="https://pentaho.mywebsite.org/pentaho/j_spring_security_check" rel="nofollow noreferrer">https://pentaho.mywebsite.org/pentaho/j_spring_security_check</a></p>
  <p>The application try to responde with HTTP protocol instead HTTPS.</p>
  <p>In the request header I have the correct Referer and Origin:
  Origin: <a href="https://pentaho.mywebsite.org" rel="nofollow noreferrer">https://pentaho.mywebsite.org</a>
  Referer: <a href="https://pentaho.mywebsite.org/pentaho/Login" rel="nofollow noreferrer">https://pentaho.mywebsite.org/pentaho/Login</a></p>
  <p>But the response header reply with HTTP and NOT https:
  Location <a href="http://pentaho.mywebsite.org/pentaho/" rel="nofollow noreferrer">http://pentaho.mywebsite.org/pentaho/</a></p>