Redirecting to HTTPS even though SSL is off

[Andy]

I installed JIRA 7.9 on 64-bit Linux and all seems to be working fine when I connect via raw IP to my server: http://1.2.3.4:8080. I used most of the default options in the installer, putting in my database and other site configuration options as requested. I have NOT configured SSL, nor do I wish to at this time. I am using the webserver built-in to the Jira installation, which I believe is Apache Tomcat. There are other webapps running on my server, but nothing on port 8080. Again, when I connect via raw IP address, everything works fine.

However, when I try to connect to the site URL specified in my configuration, http://my.server.com:8080 - I am redirected to https://my.server.com:8080 - which of course fails in my browser, because it is not actually HTTPS. It does load the page via command line in curl, but of course that is just because there is no SSL check. It seems like it is still doing the 302 Redirect.

I have verified under administration that my site URL is indeed specified as http:// and not https://. I have also verified in all the web.xml and server.xml files that I can find that nothing SSL/HTTPS is turned on. When I stop the JIRA service, the site in all forms fails to load at all, so I'm quite certain this is coming from within what was installed with JIRA rather than something else on my server. So, where is this redirect taking place and how do I turn it off? Thanks in advance.

[Andy · Accepted solution]

This one is solved: apparently HSTS was to blame. I was hosting on a subdomain of another domain on which I do host an SSL site, so apparently this was kicking in in the browser. I changed domains and the problem gone.

[Thomas Deiler]

Dear @Andy,

I have no solution for your problem. All you described sounds logical. Just some thoughts:

Are there any proxy in-between? Also the proxy config of your browser?

The described behavior sounds like a hidden redirect directive.

What happens, when you connect from localhost? (wget, curl) Same redirect?

I recommend setting yourself a personal time limit - if you cannot get rid of the problem in time, repeat the Installation without installer (from TAR file).

So long

Thomas