[[servlet-http]]
= HTTP

All HTTP based communication should be protected <<http,using TLS>>.

Below you can find details around Servlet specific features that assist with HTTPS usage.

[[servlet-http-redirect]]
== Redirect to HTTPS

If a client makes a request using HTTP rather than HTTPS, Spring Security can be configured to redirect to HTTPS.

For example, the following Java configuration will redirect any HTTP requests to HTTPS:

.Redirect to HTTPS with Java Configuration
====
[source,java]
----
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends
		WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) {
		http
			// ...
			.requiresChannel(channel ->
				channel
					.anyRequest().requiresSecure()
			);
	}
}
----
====

The following XML configuration will redirect all HTTP requests to HTTPS

.Redirect to HTTPS with XML Configuration
====
[source,xml]
----
<http>
	<intercept-url pattern="/**" access="ROLE_USER" requires-channel="https"/>
...
</http>
----
====


[[servlet-hsts]]
== Strict Transport Security

Spring Security provides support for <<servlet-headers-hsts,Strict Transport Security>> and enables it by default.

[[servlet-http-proxy-server]]
== Proxy Server Configuration

Spring Security <<http-proxy-servers,integrates with proxy servers>>.
