Hi Oz

Sounds like an F5 / proxy issue. Do try this link:

https://www.google.com/search?q=F5+SSL+offload+..+redirects+traffic+back+in+http+format&oq=F5+SSL+offload+..+redirects+traffic+back+in+http+format&aqs=chrome..69i57.329j0j4&sourceid=chrome&ie=UTF-8

Hi Andrew, 

is there any changes needed to be applied in the TOMCAT (server.xml or web.xml), 

For example: Enable the HTTPS connector in server.xml? or Forcing the redirection of HTTP to HTTPS in web.xml?

I don't have the access to my F5 as it was administrated by some other team. The message I got from them is that we need to ensure our URL redirection is always forcing back to HTTPS.

Do advise. 

Thanks. 

Hi, 

After applying the changes URL HTTP redirection to HTTPS configuration into F5, the whole site seems to be under HTTPS/SSL. 

However, it cause another bigger problem whereby we can't any submit any request / perform any action on the form. 

Further dig into the log file, it seems it violate the CSRF token security check. Any alternative resolution for this besides of turning on this feature (org.owasp.csrfguard.Enabled=false)? 

Hi Oz,

Maybe you can modify Tomcat server.xml by adding this:

<Valve
className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="x-forwarded-for"
proxiesHeader="x-forwarded-by"
protocolHeader="x-forwarded-proto" />

if your F5 ip address is not in these subnets: 10/8, 192.168/16, 169.254/16 and 127/8, then you need to have "internalProxies" parameters. 

You can refer to this link for more info.