From 94cdecc62abec52379029fcca9d96c59054a8480 Mon Sep 17 00:00:00 2001
From: Andrea Dell'Amico <andrea.dellamico@isti.cnr.it>
Date: Mon, 15 Feb 2021 15:09:41 +0100
Subject: [PATCH] Fixes #20713. Set protocolHeader="X-Forwarded-Proto".

---
 templates/tomcat-server.xml.j2 | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/templates/tomcat-server.xml.j2 b/templates/tomcat-server.xml.j2
index 3a7863a..9b9b44f 100644
--- a/templates/tomcat-server.xml.j2
+++ b/templates/tomcat-server.xml.j2
@@ -98,6 +98,16 @@
     
     <Engine name="Catalina" defaultHost="localhost">
 
+{% if not item.ajp_enabled %}
+      <!-- Automatically substitutes the IP with the one contained
+             in the x-forwarded-for header if that header is set -->
+           <Valve className="org.apache.catalina.valves.RemoteIpValve"
+                  remoteIpHeader="X-Forwarded-For"
+                  protocolHeader="X-Forwarded-Proto"
+                  protocolHeaderHttpsValue="https"
+                  />
+{% endif %}
+
       <!-- Use the LockOutRealm to prevent attempts to guess user passwords
            via a brute-force attack -->
       <Realm className="org.apache.catalina.realm.LockOutRealm">
@@ -123,9 +133,6 @@
             >
 
 {% if item.access_log_enabled %}
-        <!-- Automatically substitutes the IP with the one contained
-             in the x-forwarded-for header if that header is set -->
-        <Valve className="org.apache.catalina.valves.RemoteIpValve" />
         <!-- Access log processes all example.
              Documentation at: /docs/config/valve.html
              Note: The pattern used is equivalent to using pattern="combined" -->