Spring 引导 2.x - 自动将 HTTP 重定向到 HTTPS

Question

I've been trying to find a simple answer to the following question:
"How do I configure Spring Boot 2.x to automatically redirect requests from HTTP to HTTPS?"

The Spring classes involved appear to have changed from Spring Boot 1.x to 2.x, so people who have already asked/answered this question for Spring Boot 1.x have left information that no longer works in 2.x. I was able to figure out the solution myself from various sources, so I'm going to answer my own question. If someone else has an even cleaner solution, then I'll accept it and probably use it in my own application.

The 'challenge' in solving this problem is that there does not appear to be a simple configuration-only solution to making the embedded Tomcat servlet container listen on two ports. If there is a way, then I haven't found it. A small amount of coding was required to add a custom Connector to the TomcatServletWebServerFactory , and then configure the Connector to listen on a second port (the HTTP port) and redirect to the HTTPS port.

Answer 1

My solution was to implement the WebServerFactoryCustomizer interface, and add a custom Connector to the web server factory instance.

@Component
public class MyWebServerFactoryCustomizer implements WebServerFactoryCustomizer<TomcatServletWebServerFactory> {

    private static final Logger LOGGER = LoggerFactory.getLogger(MyWebServerFactoryCustomizer.class);

    @PostConstruct
    void postConstruct() {
        LOGGER.debug("postConstruct() | INVOKED");
    }

    private final int httpPort;
    private final int redirectToHttpsPort;

    @Autowired
    MyWebServerFactoryCustomizer(
            @Value("${server.http.port}") int httpPort,
            @Value("${server.redirect.to.https.port}") int redirectToHttpsPort) {
        this.httpPort = httpPort;
        this.redirectToHttpsPort = redirectToHttpsPort;
    }

    @Override
    public void customize(TomcatServletWebServerFactory factory) {
        factory.addAdditionalTomcatConnectors(redirectConnector());
    }

    private Connector redirectConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        connector.setPort(httpPort);
        connector.setSecure(false);
        connector.setRedirectPort(redirectToHttpsPort);
        return connector;
    }

}

Inside my application.properties file, I need to provide values for the two port number, plus some other stuff related to the keystore that provides my secure HTTPS connections:

#--------------------------------------------------------------------------------------------------
# SSL CONFIGURATION
server.ssl.key-store-type=PKCS12
server.ssl.key-store=classpath:keystore/jimtough-dot-org-keystore.pkcs12
server.ssl.key-store-password=mykeystorepassword
server.ssl.key-alias=jimtough-dot-org
server.ssl.enabled=true
server.port=8443
# These two are not standard property keys. I use them to map the HTTP port to the HTTPS port.
server.http.port=8080
server.redirect.to.https.port=8443
#--------------------------------------------------------------------------------------------------

My solution also required some extra Spring Security configuration, as shown below:

@Configuration
@EnableWebSecurity
public class SpringSecurityConfiguration extends WebSecurityConfigurerAdapter {

    private final int httpPort;
    private final int redirectToHttpsPort;

    @Autowired
    SpringSecurityConfiguration(
            @Value("${server.http.port}") int httpPort,
            @Value("${server.redirect.to.https.port}") int redirectToHttpsPort) {
        this.httpPort = httpPort;
        this.redirectToHttpsPort = redirectToHttpsPort;
    }

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .authorizeRequests(authorize -> {
                // The following paths do not require the user to be authenticated by Spring Security
                authorize.antMatchers("/", "/favicon.ico", "/login", "/vendor/**").permitAll();
            })
            // All other request paths not covered by the list above can only be viewed by an authenticated user
            .authorizeRequests().anyRequest().authenticated()
            .and()
            .portMapper().http(httpPort).mapsTo(redirectToHttpsPort)
            .and()
            .requiresChannel().anyRequest().requiresSecure()
            .and()
            // This should redirect HTTP requests to HTTPS
            .formLogin()
            .and()
            // Use HTTP Basic authentication
            .httpBasic();
    }

}

The relevant parts above are the .portMapper().http(httpPort).mapsTo(redirectToHttpsPort) and .requiresChannel().anyRequest().requiresSecure() bits. These should force the requester from HTTP to HTTPS automatically.

Note that my solution uses three configuration properties:

• server.port
• server.http.port
• server.redirect.to.https.port

This can be simplified to only use two properties (just use server.port wherever I've used server.redirect.to.https.port ). I have a special case that I'm still trying to work out that required me to add the third configuration property. You probably don't need it.

---

If you're just getting started with HTTPS and Spring Boot, and you don't know how to enable HTTPS at all, then https://stackoverflow.com/a/65384432/346112 might also be of interest to you.

---

One more note on this. I eventually chose to use 'nginx' as a reverse-proxy in front of my Spring Boot application on the server. This moved the SSL/HTTPS configuration to a higher level, and allows nginx to terminate the HTTPS connection and forward the traffic to my Spring Boot app unencrypted. I think this is a better solution. I no longer need to mess with Java keystores or any of the Spring Boot/Tomcat configuration to listen on multiple ports, forward traffic, etc. Spring Boot can just run happily on HTTP with port 8080 and let nginx deal with the rest. This does require a few Spring Boot settings in application.properties :

server.port=8080
server.ssl.enabled=false
server.forward-headers-strategy=NATIVE
# optional
server.servlet.session.timeout=1d
server.servlet.session.cookie.max-age=1d