When Strategy Library is running behind a load balancer or reverse proxy, where the outfacing URL uses the HTTPS protocol, users have seen HTTPS dropped (browser showing only HTTP) after they seamlessly log in to Library from Strategy Web. Similar behavior has also been reported when using SAML to log in to Library.
This is a very common problem when the load balancer or reverse proxy is set to use HTTPS on the outside, but communicate internally only with HTTP. The problem is usually related to redirects. In this case, the Library application is trying to redirect the user to the homepage after logging in. It is constructing the redirect URL but it has no information about what is beyond the load balancer or reverse proxy. It can only use the information passed inside, which is why the constructed redirect URL uses HTTP.
Strategy Library is not the only application that does this kind of redirect. There are general solutions to this problem that are outside of the application, listed below.
Users can see different kinds of redirect URL alteration problems depending on how the load balancer or reverse proxy is set up and how the application constructs redirect URLs. In this specific case of "HTTPS stripping," the most common solution is to configure the load balancer or reverse proxy to redirect all HTTP traffic to HTTPS so that users are never able to visit the website through bare HTTP.
In cases where solution no. 1 is not feasible, the problem can be solved by making the internal communication behind the load balancer or reverse proxy to use HTTPS too, so that Library would construct the redirect URL using HTTPS. To do this, follow documents of the application server (for example Tomcat) that runs the Library application to set up HTTPS and have the load balancer or reverse proxy connect to it through HTTPS.
