disable https on localhost only

Question

I'm using tomcat 7 and I would like to disable SSL traffic origination from localhost only! and enable it for inbound traffic.

I have added the following config to web.xml and it's currently redirects traffic from http to https.

<security-constraint>
    <web-resource-collection>
        <web-resource-name>app</web-resource-name>
        <url-pattern>/info</url-pattern>
    </web-resource-collection>
    <!-- OMIT auth-constraint -->
</security-constraint>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>app</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>Role</role-name>
    </auth-constraint>
</security-constraint>

I have a custom backup tool on my server that doesn't work with HTTPs therefore I'm looking to disable HTPPs on localhost.

I beg to differ, this question is for localhost traffic only! and not disable SSL entirely — Deano, Aug 23 '17 at 05:27
I want to achieve the same. Kindly share the solution if there is any. — kaushik, Jan 05 '21 at 06:19

score 2 · Answer 1 · answered Aug 23 '17 at 05:05

2

you can comment below line in your server.xml file.

<Connector port="8443" ... SSLEnabled="true" scheme="https" secure="true" sslProtocol="TLS" ... />

hope this will help !!

answered Aug 23 '17 at 05:05

Yogesh

715
1
7
20

score 0 · Answer 2 · answered Mar 16 '21 at 17:05

You can disable specific url just putting NONE on transport-guarantee tag, check Is security-constraint configuration for Tomcat mandatory?

<security-constraint>
    <web-resource-collection>
        <web-resource-name>securedapp</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>
<security-constraint>
    <web-resource-collection>
        <web-resource-name>securedapp</web-resource-name>
        <url-pattern>/info/*</url-pattern>
        <url-pattern>/info2/*</url-pattern>
        <url-pattern>/info3/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

disable https on localhost only

2 Answers2