Confluence Redirect HTTP Requests to HTTPS
Asked by Dar Francisco:

How do you redirect http requests to https


Answers:
author: noamdah
body: On server.xml file:

Linux path: /opt/atlassian/confluence/conf/server.xml

Windows path: C:\\Program Files\\Atlassian\\Confluence\\conf\\server.xml

Leave the original port open:

Example:

\<Connector port="8090" connectionTimeout="20000" redirectPort="8443" maxThreads="48" minSpareThreads="10" enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8" protocol="org.apache.coyote.http11.Http11NioProtocol" /\>

Along with ssl port:

Example:

\<Connector port="8443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" protocol="org.apache.coyote.http11.Http11NioProtocol" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocols="TLSv1,TLSv1.1,TLSv1.2" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" SSLEnabled="true" URIEncoding="UTF-8" keystorePass="changeit" keystoreFile="/var/atlassian/key.jks"/\>

Add to web.xml:

Linux path: /opt/atlassian/confluence/confluence/WEB-INF/web.xml

Windows path: C:\\Program Files\\Atlassian\\Confluence\\confluence\\WEB-INF\\web.xml

Add:

\<security-constraint\> \<web-resource-collection\> \<web-resource-name\>all-except-attachments\</web-resource-name\> \<url-pattern\>/\*\</url-pattern\> \</web-resource-collection\> \<user-data-constraint\> \<transport-guarantee\>CONFIDENTIAL\</transport-guarantee\> \</user-data-constraint\> \</security-constraint\>

Before end of web.xml file: \</web-app\>

\*Restart confluence service post changes on these files for the configuration to take place.

\*Recommended to always do server side changes on test env before implementing on prd env

comments: author: Dane Kantner
body: The security-constraint is essential to making it actually work! :\] It doesn't redirect just based off of the redirect= statements in server.xml alone, it seems.

But, why are we excluding (seemingly) attachments from SSL?

Also, is it a bug in Confluence that some items are sent non-secure, which in turn gives a browser warning? <http://confluence.hey.com/download/resources/com.atlassian.confluence.plugins.system-templates:system-template-resources/assets/images/welcome.png> for example is sent non-secure even when I have redirects in place.


author: Eliza Jamison
body: DOES NOT WORK FOR CONFLUENCE! Fine for JIRA

\<security-constraint\>  
\<web-resource-collection\>  
\<web-resource-name\>all-except-attachments\</web-resource-name\>  
\<url-pattern\>/\*\</url-pattern\>  
\</web-resource-collection\>  
\<user-data-constraint\>  
\<transport-guarantee\>CONFIDENTIAL\</transport-guarantee\>  
\</user-data-constraint\>  
\</security-constraint\>

and my server XML file is correct...GRRRR


author: Daniel Hahn
body: Eliza worked for me

*\<!-- http redirect to https --\>*   
\<security-constraint\>  
\<web-resource-collection\>  
\<web-resource-name\>Restricted URLs\</web-resource-name\>  
\<url-pattern\>/\*\</url-pattern\>  
\</web-resource-collection\>  
\<user-data-constraint\>  
\<transport-guarantee\>CONFIDENTIAL\</transport-guarantee\>  
\</user-data-constraint\>  
\</security-constraint\>


author: Aleks Yenin (Polontech)
body: \<rule\>

\<condition type="scheme" operator="equal"\>https\</condition\>

[example.com](http://example.com)"\>operator="equal"\>[example.com](http://example.com)

\<condition type="port" operator="equal"\>443\</condition\>

\<from\>\^/(.\*)\</from\>

[http://example.com/$1](http://example.com/$1%3C/to%3E)

\</rule\>  
You may have a look at

<https://confluence.atlassian.com/fishkb/how-do-i-redirect-http-requests-to-https-without-proxy-707724570.html>