Redirect browsers to https when forceSsl is set

This commit extends the forceSsl support to redirect any HTML content
to https. Practically speaking, this allows to redirect all browsers to
https when they land on the main page using https. Serving traffic via
http is still allowed as preventing this would break a lot of
existing clients.

To allow to easily run the app locally, forceSsl is false and must be
enabled for any production environment.

Closes gh-473

initializr-service/src/main/resources/application.yml

@@ -12,6 +12,7 @@ server:
     enabled: true
     mime-types: application/json,text/css,text/html
     min-response-size: 2048
+  use-forward-headers: true
 
 spring:
   jackson:

initializr-service/src/test/java/io/spring/initializr/service/InitializrServiceHttpsTests.java

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2012-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.spring.initializr.service;
+
+import java.net.URI;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.core.AutoConfigureCache;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.boot.web.server.LocalServerPort;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.RequestEntity;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Integration tests for {@link InitializrService} that force https.
+ *
+ * @author Stephane Nicoll
+ */
+@RunWith(SpringJUnit4ClassRunner.class)
+@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT, properties = "initializr.env.force-ssl=true")
+@AutoConfigureCache
+public class InitializrServiceHttpsTests {
+
+	@Autowired
+	private TestRestTemplate restTemplate;
+
+	@LocalServerPort
+	private int localPort;
+
+	@Test
+	public void httpCallRedirectsToHttps() {
+		RequestEntity<Void> request = RequestEntity.get(URI.create("/"))
+				.accept(MediaType.TEXT_HTML).build();
+		ResponseEntity<String> response = this.restTemplate.exchange(request,
+				String.class);
+		assertThat(response.getStatusCode()).isEqualTo(HttpStatus.FOUND);
+		assertThat(response.getHeaders().getLocation()).isEqualTo(
+				URI.create(String.format("https://localhost:%s/", this.localPort)));
+	}
+
+	@Test
+	public void securedProxiedCallDoesNotRedirect() {
+		RequestEntity<Void> request = RequestEntity.get(URI.create("/"))
+				.header("X-Forwarded-Proto", "https").accept(MediaType.TEXT_HTML).build();
+		ResponseEntity<String> response = this.restTemplate.exchange(request,
+				String.class);
+		assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+	}
+
+}

initializr-service/src/test/java/io/spring/initializr/service/InitializrServiceSmokeTests.java

@@ -28,6 +28,7 @@ import org.junit.Test;
 import org.junit.runner.RunWith;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.core.AutoConfigureCache;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
 import org.springframework.boot.test.web.client.TestRestTemplate;
@@ -47,6 +48,7 @@ import static org.assertj.core.api.Assertions.assertThat;
  */
 @RunWith(SpringJUnit4ClassRunner.class)
 @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
+@AutoConfigureCache
 public class InitializrServiceSmokeTests {
 
 	@Autowired