How redirect a request to https

[vns955]

Hello all!

I wish to redirect my start page to https, that is I need that a request http;//localhost:8080/mysite should be redirected to https;//localhost:8443/mysite. I'm working with Spring 2.0, Tomcat 6.

Thanks!

[travishein]

Something like this is likely best done in a servlet filter, that is mapped to the path(s) or path pattern(s) you wish to enforce https only acess on.

The HttpServletRequest object contains four useful methods to help us

isSecure() : returns true if the request is coming in on a https connection (thus, we would not need to do a redirect

getServerName() : returns the dns name that this request was invoked with

getRequestUri() : returns the full url path this request was invoked with

getQueryString() : returns the query parameters, if any this request was invoked with.

Putting these ideas together, the doFilter() method of your filter might look something like:

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        // if the scheme is not https
        if (!request.isSecure()) {
            // generate full URL to https
            StringBuilder newUrl = new StringBuilder("https://");
             newUrl.append(request.getServerName());
            if (httpRequest.getRequestURI() != null) {
                newUrl.append(httpRequest.getRequestURI());
            }
            if (httpRequest.getQueryString() != null) {
                newUrl.append("?").append(httpRequest.getQueryString());
            }

            httpResponse.sendRedirect(newUrl.toString());
        }
        else {
          // already a secure connection, no redirect to https required.
            if (chain != null) {
                chain.doFilter(request, response);
            }
        }
    }

Where here I assume the redirect server name is the same as the http name and the port is the https default. if this is not the case, these could be specified as init parameters in the web.xml.