Confluence Redirect HTTP Requests to HTTPS

[Dar Francisco]

How do you redirect http requests to https

[noamdah]

On server.xml file:

Linux path:  /opt/atlassian/confluence/conf/server.xml

Windows path: C:\Program Files\Atlassian\Confluence\conf\server.xml    

Leave the original port open:  

Example:

  <Connector port="8090"                  connectionTimeout="20000" redirectPort="8443"                 maxThreads="48" minSpareThreads="10"                 enableLookups="false"                  acceptCount="10"                  debug="0"                  URIEncoding="UTF-8"                 protocol="org.apache.coyote.http11.Http11NioProtocol" />  

 Along with ssl port:

Example:

  <Connector port="8443" maxHttpHeaderSize="8192"                    maxThreads="150" minSpareThreads="25"                    protocol="org.apache.coyote.http11.Http11NioProtocol"                    enableLookups="false" disableUploadTimeout="true"                    acceptCount="100" scheme="https" secure="true"                    clientAuth="false" sslProtocols="TLSv1,TLSv1.1,TLSv1.2" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" SSLEnabled="true"                    URIEncoding="UTF-8" keystorePass="changeit" keystoreFile="/var/atlassian/key.jks"/>

Add to web.xml:  

Linux path: /opt/atlassian/confluence/confluence/WEB-INF/web.xml

Windows path: C:\Program Files\Atlassian\Confluence\confluence\WEB-INF\web.xml

Add:

<security-constraint>         <web-resource-collection>                 <web-resource-name>all-except-attachments</web-resource-name>                  <url-pattern>/*</url-pattern>         </web-resource-collection>         <user-data-constraint>                 <transport-guarantee>CONFIDENTIAL</transport-guarantee>         </user-data-constraint> </security-constraint>

Before end of web.xml file: </web-app>

*Restart confluence service post changes on these files for the configuration to take place.

*Recommended to always do server side changes on test env before implementing on prd env

[Dane Kantner]

The security-constraint is essential to making it actually work! :]     It doesn't redirect just based off of the redirect= statements in server.xml alone, it seems.

But, why are we excluding (seemingly) attachments from SSL? 

Also, is it a bug in Confluence that some items are sent non-secure, which in turn gives a browser warning?  http://confluence.hey.com/download/resources/com.atlassian.confluence.plugins.system-templates:system-template-resources/assets/images/welcome.png for example is sent non-secure even when I have redirects in place.

[Eliza Jamison]

DOES NOT WORK FOR CONFLUENCE!  Fine for JIRA

<security-constraint>
<web-resource-collection>
<web-resource-name>all-except-attachments</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

and my server XML file is correct...GRRRR

[Daniel Hahn]

Eliza worked for me

<!-- http redirect to https -->
<security-constraint>
<web-resource-collection>
<web-resource-name>Restricted URLs</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

[Aleks Yenin (Polontech)]

<rule>

<condition type="scheme" operator="equal">https</condition>

example.com">operator="equal">example.com

<condition type="port" operator="equal">443</condition>

<from>^/(.*)</from>

http://example.com/$1

</rule>
 You may have a look at 

https://confluence.atlassian.com/fishkb/how-do-i-redirect-http-requests-to-https-without-proxy-707724570.html