Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On a simple tomcat 7 installation with https, sending an http request on the https port returns a strange response of three control characters:

$ wget -q -S -O - http://127.0.0.1:8443/
^U^C^@

[I have used caret-char combination as I can't paste the original.]

If possible I want to change it to redirecting to https or return 404 or some other custom behavior. Is this possible?

share|improve this question
1  
You would need something that could autodetect whether the client was using SSL. –  David Schwartz Aug 14 '13 at 22:02

1 Answer 1

up vote 0 down vote accepted

Sending HTTP on HTTPS dedicated port is not expected normally, though possible. In practice, production is running on 80 and 443 ports, so that is not really an issue unless somebody is sort of "hacking". In case different ports are used (eg. default Tomcat's) then the problem might arise just because people will forget to type "https" in front of URL.

In any case standard behavior is to return HTTP 400 Bad Request. This is done eg. by Apache web server.

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Reason: You're speaking plain HTTP to an SSL-enabled server port.<br />
Instead use the HTTPS scheme to access this URL, please.<br />
</p>
</body></html>

Tomcat TLS/SSL HTTP connector doesn't do this obviously, and I suspect that it replies with some TLS handshake error message (discussed partially here http://stackoverflow.com/questions/7164944/unexpected-results-when-attempting-to-access-tomcat-6-https-connector-using-http).

In production, SSL is usually terminated on reverse proxy server (such as Apache) which handles even such a bad request gracefully (as described above).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.