CODEWITHSUNDEEP
tomcatsslweb.xml
Stephan Markwalder
Stephan Markwalder

Reputation: 233

Force Tomcat to redirect to HTTPS without changing web.xml security constraints

I already know how to configure Tomcat so that it redirects HTTP requests to HTTPS:

  1. enable and configure the SSL connector
  2. set correct "redirectPort" attribute on the non-SSL connector
  3. modify web.xml and set the "transport-guarantee" to "CONFIDENTIAL"

My question is: Is there a way to achieve the same result WITHOUT modifying the web.xml file?

I'm looking for a solution where I do not have to change the web application, which is deployed as WAR file. So changes like adding a servlet filter or implementing the redirect inside the web application are not an option.

Thanks for any help!

Stephan

Upvotes: 2

Views: 3316

Answers (2)

Ingar Bekkelund
Ingar Bekkelund

Reputation: 31

If you don't want to modify the application WAR file, you can also add this entry to the server WEB.XML (/tomcat/conf/web.xml) and limit which webapps this parameter applies to?

Upvotes: 3

Jukka
Jukka

Reputation: 4663

Consider implementing a custom Tomcat Valve for doing the redirect. ValveBase is a good start.

Upvotes: 2

Related Questions