Running hybris in https only

[#1]

How can hybris 5.5.1 Telco Accelerator be configured to permanently run in https mode instead of switching between http and https?

[Former Member]

You could also try changing it at tomcat level in web.xml.

 <!-- Require HTTPS for everything except /img (favicon) and /css. -->
     <security-constraint>
         <web-resource-collection>
             <web-resource-name>HTTPSOnly</web-resource-name>
             <url-pattern>/*</url-pattern>
         </web-resource-collection>
         <user-data-constraint>
             <transport-guarantee>CONFIDENTIAL</transport-guarantee>
         </user-data-constraint>
     </security-constraint>
     <security-constraint>
         <web-resource-collection>
             <web-resource-name>HTTPSOrHTTP</web-resource-name>
             <url-pattern>*.ico</url-pattern>
             <url-pattern>/img/*</url-pattern>
             <url-pattern>/css/*</url-pattern>
         </web-resource-collection>
         <user-data-constraint>
             <transport-guarantee>NONE</transport-guarantee>
         </user-data-constraint>
     </security-constraint>

[christoph_probst]

You have to edit the spring-security-config.xml and set requires-channel="https" for all endpoints. Be aware that there may occure some problems with live edit or orbeon forms if you change this. As I know live-edit only works with http connections and orbeon forms only works with https. Hence, you should test them.

[hiddebroerse]

In spring-security-config.xml

         <!-- SSL / AUTHENTICATED pages -->
         <security:intercept-url pattern="/my-account*" access="ROLE_CUSTOMERGROUP" requires-channel="https" />
         <security:intercept-url pattern="/my-account/**" access="ROLE_CUSTOMERGROUP" requires-channel="https" />
 
         <!-- Force every page to SSL -->
         <security:intercept-url pattern="/**" requires-channel="https" />

[Former Member]

This alone does not work as it forces the user to log in.

We want the my account area and the checkout to require authentication as before, the rest of the shop should work without any authentication.

[hiddebroerse]

I changed my config example