RE: Redirecting to https URL when https port is accessed with http scheme

[Gillett, Phil]

Hello:
  Perfect timing!!
  I've been assigned at my job to apply something similar with Tomcat and 
Footprints 12, and have had some issues.
  I hope someone has a solution, and I thank you in advance!

Phil G.

-Original Message-
From: ettra lancelot  
Sent: Friday, October 5, 2018 1:57 PM
To: users@tomcat.apache.org
Subject: Redirecting to https URL when https port is accessed with http scheme

Hi,

I would like to know whether it's possible to configure tomcat to automatically 
redirect to the https URL when https port is access using http scheme instead 
of https*.*

For example, say I have configured an ssl connector on port 8443, if I access 
the connector using http scheme (eg: http://localhost:8443) instead of using 
https scheme, I'm receiving some meaningless characters  (refer [1]). Instead, 
is it possible to make an automatic redirection to the https url (eg: 
https://localhost:8443) ?

Few details about the setup.

- Tomcat version - 7.0.85
- SSL connector is configure on port 8443



- Added the following security-constrain to web.xml



HTTPSOnly
/*


CONFIDENTIAL



[1] - https://i.stack.imgur.com/1LVq7.png

Thank you,
Etcy.

RE: Why move to tomcat9 (UNCLASSIFIED)

[Gillett, Phil]

We use Footprints 12 and the requirement IS to use Tomcat 7.x, which at this 
time are using 7.0.86 and need to update to 7.0.90 (having some problems at 
this time, though).
7.0.90 IS the latest version to fix the latest security issues.

-Original Message-
From: Mark Thomas  
Sent: Wednesday, August 29, 2018 10:23 AM
To: users@tomcat.apache.org
Subject: Re: Why move to tomcat9 (UNCLASSIFIED)

On 29/08/18 15:56, M. Manna wrote:
> The key benefit is - You get all recent CVE patches which protects 
> your product more from known vulnerabilities.

Not correct. All currently supported Tomcat versions (7.0.x, 8.5.x and
9.0.x) receive security fixes.

> You can see a comparison table here -
> http://tomcat.apache.org/whichversion.html
> 
> I would recommend that you review Servlet, Connector, and Java version 
> related changes carefully (if you have hard dependency on them). it 
> would be better to move to 8.5 first in my opinion, but no harm going 
> to 9.x directly if your product is okay.

The Tomcat community supports 3 major versions in parallel. Currently that is 
7.0.x, 8.5.x and 9.0.x. 7.0.x will be the next to reach end-of-life - although 
not for a good while yet. [1]

Depending on how long your organisation takes to upgrade from one major version 
to another, you might want to start your migration soon. The longer this 
process takes for your organisation, the better off you are moving to 9.0.x 
since it will be supported for longer than 8.5.x.

Also, see http://tomcat.apache.org/migration.html

Mark

[1] https://markmail.org/message/5klk3rtf4mb2aacv

> Regards,
> 
> On Wed, 29 Aug 2018 at 15:52, Lueders, Paul T CIV USARMY NGIC (US) < 
> paul.t.lueders@mail.mil> wrote:
> 
>> CLASSIFICATION: UNCLASSIFIED
>>
>> I would like to migrate from tomcat 7.0.90 to the latest version of 
>> tomcat9.  Is there a document that lists the benefits of tomcat9 and 
>> the differences between tomcat7 and tomcat9
>>
>> Thanks
>> Paul
>> CLASSIFICATION: UNCLASSIFIED
>>
>> -
>> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
>> For additional commands, e-mail: users-h...@tomcat.apache.org
>>
>>
> 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org