Spring Boot can be very easily configured to require HTTPS for all requests. In application.properties, simply set
security.require-ssl=true
And that works great – until you’re running the Spring Boot application on AWS Elastic Beanstalk with both HTTP and HTTPS listeners:
In that case, Elastic Beanstalk’s health check is always done over HTTP. The configuration page even says as much (there is no option to change it to be over HTTPS):
Since Spring Boot will redirect all non-secure HTTP requests to HTTPS, the health check will see an HTTP 302 redirect and therefore fail.
To workaround this issue (and in my opinion, AWS shortcoming), Spring Boot needs to be configured to allow insecure requests to the health check URL. To do so, we’ll define a new URL (/aws-health) that proxies Actuator’s health URL but responds over http and https.
In your security configuration class (named WebSecurityConfiguration below as an example) which extends WebSecurityConfigurerAdapter, add the following to the existing implementation of configure(HttpSecurity) (or create that method if it doesn’t already exist):
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.access.channel.ChannelDecisionManagerImpl;
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(final HttpSecurity http) throws Exception {
// Elastic Beanstalk health checks only happen over HTTP, so as a workaround// create a new URL (/aws-health) that forwards to the Actuator health check, see InsecureHealthController// That URL is set to respond over any channel (not just secure, aka https, ones)// see https://candrews.integralblue.com/2017/03/spring-boot-https-required-and-elastic-beanstalk-health-checks/http.requiresChannel()
.antMatchers("/aws-health").requires(ChannelDecisionManagerImpl.ANY_CHANNEL)
.anyRequest().requiresSecure();
}}
Now create the controller:
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;
import org.springframework.boot.actuate.autoconfigure.ManagementServerProperties;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.util.UriComponentsBuilder;
/*** Elastic Beanstalk health checks only happen over HTTP, so as a workaround* create a new URL (/aws-health) that forwards to the Actuator health check* That URL is set to respond over any channel (not just secure, aka https, ones) in {@link WebSecurityConfiguration}** @see https://candrews.integralblue.com/2017/03/spring-boot-https-required-and-elastic-beanstalk-health-checks/*/public class InsecureHealthController {
private final ManagementServerProperties management;
public InsecureHealthController(ManagementServerProperties management) {
this.management = management;
}@RequestMapping(value="/health", method=RequestMethod.GET)
public void health(final HttpServletRequest request, final HttpServletResponse response) throws ServletException, IOException{
final String healthUrl = UriComponentsBuilder.fromPath(management.getContextPath()).path("/aws-health").toUriString();
final HttpServletRequestWrapper requestWrapper = new HttpServletRequestWrapper(request){
@Override
public boolean isSecure() {
return true;
}};
request.getRequestDispatcher(healthUrl).forward(requestWrapper, response);
}}
Spring Boot, HTTPS required, and Elastic Beanstalk health checks by Craig Andrews is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
What are all libraries needed in gradle file for InsecureHealthController to work?
Just Spring Boot actuator and web. You can see the an example build.gradle by going to https://start.spring.io/ selecting “Gradle” and the dependencies “Actuator” and “Web”