Redirect HTTP to HTTPS:PORT in Tomcat

问题

I have a running tomcat application that already have the following redirection rule from HTTP to HTTPs:

<Connector executor="tomcatThreadPool"
               port="80" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="443" />

Is it possible to add an exception/rule, that a specific HTTPrequest (http://www.example.com), will be redirected to another specific address , with a port specified (say https://www.example.com:8443/test), without changing/removing the above Connector ?

回答1:

The connector configuration you shown does not redirect a specific URL in the way you suppose.

That configuration acts if you have configured a CONFIDENTIAL transport guarantee for a web application inside that servlet container.

I mean, if you have deployed any application on that connector, where its web.xml descriptor has a security-constraint as follows:

<security-constraint>

    <web-resource-collection>
        <web-resource-name>Secured</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>

    ...

    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>

</security-constraint>

Then, Tomcat will redirect any matching url-pattern to the configured port in order to use HTTPS as guarantor of confidentiality in transport.

So, if you want to redirect a specific URL, you have to complement connector's configuration with specific application configuration.

Edit

As you suggest in your comment, it could be another step to get this configuration working. Once you have configured http connector as shown, and then configured app as I told you, you only to ensure that your Tomcat server has an HTTPS connector configured, other way redirection won't work.

To configure this HTTPS connector, you can use a configuration as following:

<Connector connectionTimeout="20000"
    acceptCount="100" scheme="https" secure="true"
    port="443" clientAuth="false" sslProtocol="TLS"  
    keystoreFile="PATH_TO_KEY_STORE"  
    keystorePass="KEY_STORE_PASS"  
    keyAlias="KEY_STORE_ALIAS"/>

This is a sample configuration where I didn't put some attributes that can be important for you as threads attrs, executors, and so on.

The most important thing is the KeyStore configuration that you need to serve HTTPS connections. Here you have the official documentation to prepare a java KeyStore for Tomcat to serve HTTPS.

回答2:

You can do it to every app deployed to tomcat by adding this to the end of tomcat_dir/conf/web.xml:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Entire Application</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <!-- auth-constraint goes here if you requre authentication -->
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

So you don't have to change it on the web.xml of your webapp.

That should work, assuming you already have https working in another port (usually 443). If you don't, make sure your tomcat_dir/conf/server.xml looks like this:

<!-- Default tomcat connector, changed the redirectPortport from 8443 to 443 -->
<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="443" />

<!-- To make https work on port 443 -->
<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
        maxThreads="150" SSLEnabled="true">
    <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"/>
    <SSLHostConfig>
        <Certificate certificateKeyFile="/your/own/privkey.pem"
            certificateFile="/eyour/own/cert.pem"
            certificateChainFile="/your/own/chain.pem"
            type="RSA" />
    </SSLHostConfig>
</Connector>

回答3:

I have a running tomcat application that already have the following redirection rule from HTTP to HTTPs:

As malaguna answered, that Connector configuration is not a redirection rule. It is just a setting that is used when performing redirection triggered by <transport-guarantee>CONFIDENTIAL</transport-guarantee>.

There is no way to overwrite that setting on per-application basis.

If you need better control over such redirection, you need to implement your own Filter that will implement a redirection (if (!request.isSecure()) { response.sendRedirect(...);}), or configure a 3rd party one.

// Technically, in current Tomcat 8 code the redirection triggered by transport-guarantee is performed by org.apache.catalina.realm.RealmBase.hasUserDataPermission(...) method.

回答4:

If you use tomcat with httpd, you can use RewriteEngine.

With port specified is like the followings in the http.conf:

NameVirtualHost *:8443 #your specified port
<VirtualHost *:8443>
   ServerName www.example.com
   Redirect permanent / https://secure.example.com/
</VirtualHost>

See: RewriteHTTPToHTTPS and Redirect Request to SSL

回答5:

        <Connector connectionTimeout="20000" port="8081" protocol="HTTP/1.1" redirectPort="443"/>

        <Connector port="443" 
               SSLEnabled="true" 
               acceptCount="100" 
               disableUploadTimeout="true" 
               enableLookups="false" 
               maxHttpHeaderSize="8192" 
               maxThreads="550" 
               minSpareThreads="25"  
               scheme="https" 
               secure="true" 
               compression="on"
               protocol="org.apache.coyote.http11.Http11NioProtocol" 
               sslImplementationName="org.apache.tomcat.util.net.openssl.OpenSSLImplementation">
                   <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"/> 
                   <SSLHostConfig protocols="TLSv1.2" 
                                  certificateVerification="none" 
                                  ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA">
                                        <Certificate type="RSA" 
                                                     certificateKeystoreFile="/ssl/self-signed/your-keystore.jks" 
                                                     certificateKeystorePassword="123456" 
                                                     certificateKeyAlias="your-alias" /> 
                    </SSLHostConfig>
        </Connector>