title: How to get SpringSecurity/Grails to play nicely with a Load Balancer that is terminating SSL
body: <p>We have a Grails app on Tomcat deployed behind a Load Balancer that is terminating SSL (the load balancer then communicates with tomcat instances on port 8080).  We have configured SpringSecurity to require a secure channel on all resources, pay attention to the headers from the load balancer, to force https and to map the ports from the load balancer:</p>
  
  <pre><code>grails.plugin.springsecurity.secureChannel.useHeaderCheckChannelSecurity = true
  grails.plugin.springsecurity.auth.forceHttps = true
  grails.plugin.springsecurity.portMapper.httpPort = 80
  grails.plugin.springsecurity.portMapper.httpsPort = 443
  grails.plugin.springsecurity.secureChannel.definition = [
          '/**': 'REQUIRES_SECURE_CHANNEL'
  ]
  </code></pre>
  
  <p>Most of this is working correctly - redirects from within Grails are using the https protocol as expected, as well as most ajax requests.</p>
  
  <p>There are some ajax requests however that are <em>not</em> working correctly.  They all relate to results of interacting with j_spring_security* endpoints like j_spring_security_check.  For example, if a user tries to login via ajax, we get this error in the browser (this is the redirect that the successful login initiates):</p>
  
  <pre><code> Mixed Content: The page at 'https://www.servernamehere.com/' was loaded over HTTPS, but 
   requested an insecure XMLHttpRequest endpoint 'http://www.servernamehere.com/login/ajaxSuccess'.
   This request has been blocked; the content must be served over HTTPS.
  </code></pre>
  
  <p>The same problem happens upon unsuccessful authentication: </p>
  
  <pre><code>Mixed Content: The page at 'https://www.servernamehere.com/' was loaded over HTTPS, but requested 
  an insecure XMLHttpRequest endpoint 'http://www.servernamehere.com/login/authfail?ajax=true'. 
  This request has been blocked; the content must be served over https.
  </code></pre>
  
  <p>How can we configure spring security to understand that all redirects coming out of authentication events need to be https?</p>