title: Spring security switching to http after login. How can I keep it as https?
body: <p>I am using Spring MVC and Spring Security. My redirects were switching https to http until I found this post. Spring MVC "redirect:" prefix always redirects to http -- how do I make it stay on https?. I also had to set the redirectHttp10Compatible property to false in my AjaxUrlBasedViewResolver.</p>
  
  <p>The problem is that https still switches to http after login. Once I am logged in I can set my app back to https in the address bar and it will stick. Also, I am using IP authentication for most users in which case https stays thanks to the solution above.</p>
  
  <p>I am trying to add redirectHtp10Compatible to login_security_check or something like that but am stuck. Here my <code>security-config.xml</code>.</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
           xmlns:beans="http://www.springframework.org/schema/beans"
           xmlns:util="http://www.springframework.org/schema/util"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:context="http://www.springframework.org/schema/context"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd
           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
  &lt;global-method-security pre-post-annotations="enabled" /&gt;
  
  &lt;http auto-config='true' access-denied-page="/login"&gt;
      &lt;intercept-url pattern="/static/styles/**" filters="none" /&gt;
      &lt;intercept-url pattern="/static/scripts/**" filters="none" /&gt;
  
      &lt;intercept-url pattern="/login/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;intercept-url pattern="/error/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;intercept-url pattern="/api/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;intercept-url pattern="/ajaxTimeOut" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;intercept-url pattern="/checkSystem" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;intercept-url pattern="/adminUser/**" access="ROLE_SSADMIN" /&gt;
      &lt;intercept-url pattern="/**" access="ROLE_USER" /&gt;
  
      &lt;form-login login-page="/ajaxTimeOut" login-processing-url="/login_security_check" authentication-failure-url="/login?login_error=t" default-target-url="/" always-use-default-target="true" /&gt;
      &lt;logout logout-url="/logout" logout-success-url="/"/&gt;
      &lt;custom-filter position="PRE_AUTH_FILTER" ref="ipPreAuthFilter" /&gt;
  &lt;/http&gt;
  
  &lt;beans:bean id="ipAuthDetailsSource" class="com.mydomain.security.IPBasedPreAuthenticatedDetailsSource" /&gt;
  
  &lt;beans:bean id="ipPreAuthFilter" class="com.mydomain.security.IPPreAuthenticationFilter"&gt;
      &lt;beans:property name="authenticationManager" ref="preAuthManager" /&gt;
      &lt;beans:property name="authenticationDetailsSource" ref="ipAuthDetailsSource" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="preAuthManager" class="org.springframework.security.authentication.ProviderManager"&gt;
      &lt;beans:property name="providers"&gt;
          &lt;beans:list&gt;
              &lt;beans:ref local="preAuthProvider"/&gt;
          &lt;/beans:list&gt;
      &lt;/beans:property&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="preAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
      &lt;beans:property name="preAuthenticatedUserDetailsService" ref="preAuthUserService" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="preAuthUserService" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService" /&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider user-service-ref="userService"&gt;
          &lt;password-encoder ref="passwordEncoder" &gt;
              &lt;salt-source user-property="salt" /&gt;
          &lt;/password-encoder&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;beans:bean id="userService" class="com.mydomain.security.UserServiceImpl" /&gt;
  &lt;beans:bean id="passwordEncoder" class="com.mydomain.security.PasswordEncoder"&gt;
      &lt;beans:constructor-arg value="256" /&gt;
  &lt;/beans:bean&gt;
  </code></pre>