Spring security oauth2 wrongly using internal URL as current URI for redirection

In the Spring definition of a remote resource that is protected via OAuth2 to which the client application wants access, I set use-current-uri to true, in other words, the current URI should be used as a redirect (if available). It looks like:

<oauth:resource id="myResourceId" type="authorization_code"
    client-id="${clientId}" client-secret="${clientSecret}"
    access-token-uri="${accessTokenUri}"
    user-authorization-uri="${userAuthorizationUri}"
    use-current-uri="true"
    scope="myScope" 
    pre-established-redirect-uri="${preEstablishedRedirectUri}"/>

Now the problem is, the Spring Security OAuth2 client will pick up the current internal Tomcat URL instead of the public web application's URL. The scenario is Tomcat server sitting behind Apache server, which results in two sets of URLs:

• The public web application's URL is http://ift.tt/1w7qCCp


• The internal Tomcat URL is http://localhost:8080/myapplication/users/login

Because the redirection URL is for the authorization server (e.g., Twitter, ORCID) to use to send back the authorization code, the public web application's URL should be used, not the internal one.

By the way, I'm using the following version of spring-security-oauth2:

• spring-security-oauth2-1.0.5.RELEASE


• spring-core-3.1.2.RELEASE


• spring-security-core-3.1.3.RELEASE

Wonder if there is a way to tell Spring to use the public URL. Thanks.