private boolean isTransportSecure ( HttpServletRequest req ) { String url = req . getRequestURL ( ) . toString ( ) ; if ( req . getScheme ( ) . equals ( "https" ) ) { return true ; } String value = req . getHeader ( "X-Forwarded-Proto" ) ; if ( value != null && value . toLowerCase ( ) . equals ( "https" ) ) { return true ; } return false ; }
determine if transport is secure . Either the protocol must be https or we must see a forwarding header that indicates it was https upstream of a proxy . Use of a configuration property to allow plain http was rejected in review .