X-Forwarded-* headers are not being honored when generating Password Reset links

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.2.X, 7.3.X, Master
• Fix Version/s: 7.2.10 DXP FP15, 7.2.X, 7.3.3 CE GA4, 7.3.10 DXP GA1, Master
• Component/s: Application Security > Login/Sign in Portlet
• Labels:
  • ee-ts
  • liferay-fixpack-dxp-15-7210
• Branch Version/s:
  7.2.x
• Backported to Branch:
  Committed
• Fix Priority: 4
• Git Pull Request: https://github.com/topolik/liferay-portal/pull/835

Steps to reproduce

1. Setup Apache Web Server
   • With SSL
   • Including the following properties:

     RequestHeader set X-Forwarded-Proto "https"
     ProxyPreserveHost on
     

2. Start the apache web server
3. Setup Liferay
   • Add the following properties to the portal-ext.properties file:

     web.server.http.port=80
     web.server.https.port=443
     web.server.forwarded.protocol.enabled=true
     

4. Startup Liferay
5. Navigate to your Liferay instance, via https (e.g. https://localhost)
6. Configure the settings in Control Panel -> Server Administration -> Mail
   • As needed to receive email
7. Logout
8. Click Sign in > Forget Password
   • Reset the password for a user

 Expected Result: An https link will be sent within the Password Reset email
 Actual Result: An http link is sent within the Password Reset email.