title: Azure Application Gateway WAF and Spring Security form login setup
body: <p>I have Spring Boot Primefaces 10 application which implements Spring Security form login.
  There is custom login page login.xhtml:</p>
  <pre><code>&lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot;
        xmlns:h=&quot;http://java.sun.com/jsf/html&quot;
        xmlns:f=&quot;http://xmlns.jcp.org/jsf/core&quot;
        xmlns:p=&quot;http://primefaces.org/ui&quot;
        xmlns:pe=&quot;http://primefaces.org/ui/extensions&quot;&gt;
  
  &lt;h:head&gt;
      &lt;link href=&quot;webjars/bootstrap/5.1.0/css/bootstrap.min.css&quot; rel=&quot;stylesheet&quot;/&gt;
      &lt;script src=&quot;webjars/bootstrap/5.1.0/js/bootstrap.min.js&quot;&gt;&lt;/script&gt;
      &lt;title&gt;Login&lt;/title&gt;
  &lt;/h:head&gt;
  
  &lt;h:body&gt;
      &lt;h:form prependId=&quot;false&quot; class=&quot;col-lg-6 offset-lg-5 &quot;&gt;
          &lt;p:panelGrid columns=&quot;1&quot; styleClass=&quot;ui-fluid center ui-noborder&quot;&gt;
              &lt;h2&gt;Please sign in&lt;/h2&gt;
              &lt;p:outputLabel value=&quot;Login failed!&quot; styleClass=&quot;red&quot;
                             rendered=&quot;${!empty param['error']}&quot;/&gt;
              &lt;p:inputText id=&quot;username&quot; placeholder=&quot;User name&quot; autocomplete=&quot;new-password&quot;/&gt;
              &lt;p:password id=&quot;password&quot; placeholder=&quot;Password&quot; autocomplete=&quot;new-password&quot;/&gt;
              &lt;p:commandButton value=&quot;Login&quot; ajax=&quot;false&quot;/&gt;
          &lt;/p:panelGrid&gt;
          &lt;input type=&quot;hidden&quot; name=&quot;${_csrf.parameterName}&quot; value=&quot;${_csrf.token}&quot;/&gt;
      &lt;/h:form&gt;
  &lt;/h:body&gt;
  &lt;/html&gt;
  </code></pre>
  <p>Spring security configuration:</p>
  <pre><code>  .authorizeRequests()
      .antMatchers(
      &quot;/resources/**&quot;,
      &quot;/static/**&quot;,
      &quot;/webjars/**&quot;,
      &quot;/javax.faces.resource/**&quot;,
      &quot;/&quot;,
      &quot;/nadp.xhtml&quot;,
      &quot;/notfound.xhtml&quot;,
      &quot;/login.xhtml&quot;)
      .permitAll()
      .antMatchers(&quot;/admin/**&quot;)
      .access(accessStringProvider.createAccessString())
      .anyRequest()
      .authenticated()
      .and()
      .formLogin()
      .loginPage(&quot;/login.xhtml&quot;)
      .failureUrl(IP_ADDRESS+&quot;/login.xhtml?error=true&quot;)
      .defaultSuccessUrl(IP_ADDRESS+&quot;/admin/index.xhtml&quot;, true)
      .and()
      .logout()
      .logoutRequestMatcher(new AntPathRequestMatcher(&quot;/logout&quot;))
      .logoutSuccessUrl(IP_ADDRESS + &quot;/nadp.xhtml&quot;)
      .deleteCookies(&quot;JSESSIONID&quot;)
      .invalidateHttpSession(true)
      .clearAuthentication(true)
  </code></pre>
  <p>It is working ok without Azure Application Gateway WAF, when IP_ADDRESS in spring configuration is just IP or domain name of machine where application is deployed.
  when I'm trying to put into browser:</p>
  <p>MACHINE_IP_ADDRESS/login.xhtml then everything is ok, I can login normally.</p>
  <p>or:</p>
  <p>MACHINE_IP_ADDRESS/admin/index.xhtml then I'm redirected to login page and I can login normally also</p>
  <p>However when I configure Azure Application Gateway WAF (its backend is machine where application is deployed) and IP_ADDRESS in spring configuration is ip or domain of this Gateway, then when I'm trying to put into browser:</p>
  <p>GATEWAY_IP_ADDRESS/login.xhtml then everything is ok, I can login normally.</p>
  <p>but when I'm trying:</p>
  <p><strong>GATEWAY_IP_ADDRESS/admin/index.xhtml then I'm redirected directly to backend machine (with its ip) login: MACHINE_IP_ADDRESS/login.xhtml instead of GATEWAY_IP_ADDRESS/login.xhtml</strong></p>
  <p>How to fix this behavior ? I want to be redirected to GATEWAY_IP_ADDRESS/login.xhtml in such case.</p>
  <p>I was trying to change in spring configuration</p>
  <pre><code>.loginPage(&quot;/login.xhtml&quot;)
  </code></pre>
  <p>to</p>
  <pre><code>.loginPage(IP_ADDRESS +&quot;/login.xhtml&quot;)
  </code></pre>
  <p>but then logging in stopping to work completely (valid credentials doesn't work and I'm redirected to login page again).</p>