0

Made system update to temporarily disable HTTPS in our Tomcat server.

Previous users are still using Https:// URL to access system and receive error message because it's disabled.

Would like to redirect users from HTTPS to basic HTTP version of website.

Have tried multiple different Connectors in server.xml file, but sadly no success.

Could a tomcat wizard please share this precious knowledge?

2
  • 1
    I am assuming it will be the exact same steps as redirecting from HTTP to HTTPS but with the source and target ports switched around stackoverflow.com/questions/33208796/…
    – user313675
    Commented Jan 21, 2020 at 19:51
  • Why would you ever want to do this?
    – JimmyJames
    Commented Jan 22, 2020 at 15:35

1 Answer 1

1

Why can't you disable HTTPS and redirect requests to HTTP?

When a browser makes an HTTPS request the steps go roughly as follows...

  1. Look up the host name (FQDN) in DNS if needed to get an ip address.

  2. Get a TCP connection to the host's ip address on port 443 ( or other you define ).

  3. Try to complete a TLS (or SSL) handshake and start encrypted communication.

  4. And then (finally) the HTTP request is sent over the TLS,TCP connection.

If you disable the connector that was serving HTTPS the process fails at step 2. The browser can't get a TCP connection to port 443.

At that point it can't even send the first HTTP request or receive a redirect response.

When the process fails at step 2 you typically see a long delay followed by the browser's broken looking "site not reachable" page. A Java client typically sees a SocketException.

Can you redirect HTTPS requests to HTTP urls if you do not disable HTTPS?

Yes. This is easy. For example: You can configure a filter that responds with a redirect status code to all requests for the url path range you desire.

  • For any request to reach this code and get the response you have to enable a connector serving TLS/SSL so the request can be received.

  • Using the filter approach takes an entry in the web.xml to configure the filter, and a single source file to implement the filter, which would just send back a redirect response when the request scheme is https.

The only "configuration only" redirect feature I'm aware of (Tomcat Connector redirectPort= attribute) is specifically for http to https redirection.

If you do redirect from a url with HTTPS scheme to an HTTP url, I would expect to get some messages or indications from browsers. I have not tested that scenario.

Should you redirect requests on HTTPS urls to HTTP?

In most circumstances this is not a good idea.

  • Your site will be noted as "not secure" in browsers.

  • Using HTTP may reduce your search ranking a bit in Google. Does SEO matter?

  • Even the most public site gives users some protection by using TLS/SSL.

The main use scenarios where I have ever decided to force non-encrypted HTTP are...

  • in a development environment, for troubleshooting with packet capture.

  • in 'behind the firewall' communication between my own services for troubleshooting with packet capture.

  • in communication between services on an already encrypted IPsec VPN

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.