Jira does't redirect HTTP users properly

[Marcel van Rijzewijk]

Our Jira instance has been configured, using the Jira configuration tool, to redirect HTTP visitors to HTTPS, and the service has been restarted afterwards.

For some unknown reason, if I go to http://jira.ourcompany.com, it does not send me to the HTTPS page, but lets me log in into the HTTP environment at http://jira.ourcompany.com/secure/Dashboard.jspa and after logging in, I get a notification that the Base URL is not set correctly.

Now, if we initially go to https://jira.ourcompany.com, it does correctly send me to the corresponding HTTPS page, and let me log in there.

If I now try to go back to the HTTP, for some reason, it does forward me to the HTTPS environment.

What is happening here, and why does Jira not initially forward me to the HTTPS environment, but does it work correctly when I try to go back there after visiting the HTTPS environment once?

If I then close the browser, and open it again, the same happens all over again. To meet our security compliance, we would like to ALWAYS forward the request to HTTPS.

Tried this on both IE11 and Chrome64, and the behaviour is the same.

[Marcel van Rijzewijk · Accepted solution]

Just found the answer.

The person that configured the software, forgot to add a section to the web.xml file:

<security-constraint>
 <web-resource-collection>
  <web-resource-name>all-except-attachments</web-resource-name>
  <url-pattern>*.jsp</url-pattern>
  <url-pattern>*.jspa</url-pattern>
  <url-pattern>/browse/*</url-pattern>
  <url-pattern>/issues/*</url-pattern>
 </web-resource-collection>
 <user-data-constraint>
  <transport-guarantee>CONFIDENTIAL</transport-guarantee>
 </user-data-constraint>
</security-constraint>

[Shannon S]

Hi Marcel, Glad you were able to find that. I was actually in the middle of writing you with the same.

Take care, and have a pleasant week!

Regards,

Shannon