Fixing issue 157: tls redirect on heroku

Dockerfile.web

@@ -1,4 +1,4 @@
-FROM jeroenwillemsen/wrongsecrets:1.3.1-no-vault
+FROM jeroenwillemsen/wrongsecrets:heroku-redirect-test-no-vault
 
 ARG argBasedVersion="1.3.1"
 ENV APP_VERSION=$argBasedVersion

k8s/secret-challenge-vault-deployment.yml

@@ -30,7 +30,7 @@ spec:
         runAsNonRoot: true
       serviceAccountName: vault
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.3.1-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:heroku-redirect-test-k8s-vault
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

pom.xml

@@ -40,6 +40,7 @@
         <azure.keyvault.version>4.2.3</azure.keyvault.version>
         <azure.identity.version>1.2.0</azure.identity.version>
         <azure.keyvault.spring.version>2.2.4</azure.keyvault.spring.version>
+        <spring.security.version>5.6.1</spring.security.version>
     </properties>
 
     <dependencies>
@@ -63,6 +64,16 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-config</artifactId>
+            <version>${spring.security.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-web</artifactId>
+            <version>${spring.security.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>

src/main/java/org/owasp/wrongsecrets/HerokuWebSecurityConfig.java

@@ -0,0 +1,16 @@
+package org.owasp.wrongsecrets;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@Configuration
+public class HerokuWebSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http.requiresChannel()
+            .requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null)
+            .requiresSecure();
+    }
+}