0

I have problems getting HTTP to HTTPS redirect to work in my Tomcat.

in Server.xml I have the connectors

     <Connector port="8080" protocol="HTTP/1.1" redirectPort="8443" />

     <Connector port="8443" maxHttpHeaderSize="8192" maxThreads="100"
           minSpareThreads="25" maxSpareThreads="75"
           enableLookups="false" disableUploadTimeout="true"
           acceptCount="100" scheme="https" secure="true"
           SSLEnabled="true" clientAuth="false"
           sslProtocol="TLS" keyAlias="some_alias"
           keystoreFile="secret-keystore-files"
           keystorePass="Supersafepassword" />

and in web.xml


    <security-constraint>
        <web-resource-collection>
            <web-resource-name>HTTPSOnly</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

HTTPS works fine with no certificate issues, but when I access http://server:8080 I get redirected to https://server:8080 (same port) and not 8443 as expected.

Mattias Johansson
  • 101
  • 1
  • 3

2 Answers2

1

As already answered:

The problem was due to caching the redirect location in the browser. (Some browsers may handle redirect caching differently)

Make sure not to use the HTTP 301 redirect if you often change the location...

More Information: https://stackoverflow.com/questions/9130422/how-long-do-browsers-cache-http-301s

Ben
  • 111
  • 2
  • Thank you for the answer. Is there any way around this, otherwise I would have to make all users clear their browser cache. I will only make this change once, I hope.... – Mattias Johansson Jan 28 '22 at 07:19
  • You might temporarily add another/additional redirect or something like that. So it could be chain of redirects or you "inject" a dialog for the user to clear their cache. Something like that comes to my mind by solving this issue. Actually the answer is in the link above. Look for: "If you previously issued a 301 redirect but want to un-do that" – Ben Jan 28 '22 at 15:25
0

Seems there was something left in my Chrome browser. It works in Edge and an incognito Chrome browser

Mattias Johansson
  • 101
  • 1
  • 3