http 到 https 端口转发是漏洞吗？

Question

I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant that http or https would work on URLs for that web application.

Recently this was seen as a security risk and http is no longer being advertised. For users this has caused an issue where all the links they had which were originally http no longer work and they are having to update all their links to https.

I can't quite figure out what the vulnerability is, and if someone could shed some knowledge I would really appreciate it.

How I understand it, there are 2 paths http and https. The TMG server essentially acts as the gatekeeper that sits in front of the organisations network and forces all http traffic down the https route instead, so at no point is there any http traffic into the network.

Thanks in advance.

Answer 1

I used the security stack exchange site as suggested by Guy Incognito which provided great explanations. https://security.stackexchange.com

See my post here: https://security.stackexchange.com/questions/234742/is-http-to-https-port-forwarding-a-vulnerability/234751#234751