[tomcat] https redirect

https를 적용이 되어있는 tomcat에서 http 접속시도 시  https로 자동 rediect 해주는 법이 있다.

 

./conf/server.xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<server>
......

<Connector port="80" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="443" />

<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keystoreFile="{keystoreFile}" keystorePass="{keystorePass}" />

//웹서버 등의 특정 서버와 연결하는 부분일 경우 필요
<Connector port="8009" protocol="AJP/1.3" redirectPort="443" />

.....

</server>

./conf/web.xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
                      http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
  version="3.1">

    ...

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>HTTP</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

</web>

Tomcat에서 보안 목적으로 특정 HTTP Method를 제한이나 특정 URL만 설정하는 등도 <security-constraint>를 사용한다.