Configured SonarQube 6.1 on HTTPs using Apache but both HTTP and HTTPs works - Need only HTTPs

Question

Recently I installed SonarQube 6.1 version and I used Apache to enable HTTPs, now i am able to connect to SonarQube using both the URL's below.

Any idea how to disable the HTTP and make only HTTPs work ?

HTTPs URL = https://<SonarServer>/sessions/new
HTTP URL = http://<SonarServer>:9000/

Answer 1

According to your URL, the web front server and Apache are installing on the same host. So you just need to configure SonarQube to listen on localhost (in sonar.properties sonar.web.host=127.0.0.1) and configure Apache to do the reverse proxy for 127.0.0.1.

Answer 2

Well there are two approaches which you can try:

1. Approach, make sonar https (http://docs.sonarqube.org/display/SONARQUBE52/Running+SonarQube+Over+HTTPS)

based on the link above you could easily set sonar to https, instead of http - just be sure to provide a certificate etc.

2. you could as https://stackoverflow.com/users/2435199/eric-hartmann described, just simply bind it only to localhost

3. block 9000 from outside ips via firewall!

Imho i would stick with 1 or 2 depending on the time you would like to spend on that issue!