Disabling HTTP for bluemix api calls

Question

I am running a spring-boot application in bluemix for REST APIs. At the moment the API calls are working in both http and https. How do I disable http? What do you think?

block port 80 with a firewall? (what have you tried, can we see some relevant code?) — Timothy Groote
That is not possible. Bluemix is a cloud server. A spring-boot application has been hosted there. — Balaji Vignesh
console.bluemix.net/docs/manageapps/secapps.html#securingapps — data_henrik

Balaji Vignesh Balaji Vignesh · Accepted Answer · 2017-08-31T08:43:20

Add the following two lines in the spring-boot application.properties file

server.tomcat.internal-proxies=.*
server.use-forward-headers=true

Add the following spring configuration bean

@Configuration
public class SecurityConfiguration {
    @Bean
    public EmbeddedServletContainerFactory tomcatEmbeddedServletContainerFactory() {

        TomcatEmbeddedServletContainerFactory tomcat = new TomcatEmbeddedServletContainerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection collection = new SecurityCollection();
                collection.addPattern("/*");
                securityConstraint.addCollection(collection);
                context.addConstraint(securityConstraint);
            }
        };
        return tomcat;
    }
}

Since HTTPS is already enforced in bluemix, it is sufficient if we could just route the http calls to https. But anyway, I would be interested to know if any one knows to override this and enforce their own security certificate?

Disabling HTTP for bluemix api calls

1 Answers