HTTPS Check
The HTTPS Check verifies that the BPC can only be accessed via HTTPS. Connections using TLS (HTTPS) are encrypted and can only be read by the server (BPC) and the client (user, web browser). With an unencrypted connection, third parties may be able to view and manipulate the content of the communication.
Procedure for Securing the System
We use the Pax-Web component for network communication.
To disable HTTP, the following lines can be added to the central configuration file (bpc.env.sh or bpc.env.cmd):
-
Unix systems
-
Windows systems
# enable/disable HTTP (org.osgi.service.http.enabled)
export ORG_OPS4J_PAX_WEB_ORG_OSGI_SERVICE_HTTP_ENABLED=false
# enable/disable HTTPS (org.osgi.service.http.secure.enabled)
export ORG_OPS4J_PAX_WEB_ORG_OSGI_SERVICE_HTTP_SECURE_ENABLED=truerem enable/disable HTTP (org.osgi.service.http.enabled)
SET ORG_OPS4J_PAX_WEB_ORG_OSGI_SERVICE_HTTP_ENABLED=false
rem enable/disable HTTPS (org.osgi.service.http.secure.enabled)
SET ORG_OPS4J_PAX_WEB_ORG_OSGI_SERVICE_HTTP_SECURE_ENABLED=trueThese lines are already present in the configuration file provided by the installation, but they are commented out.
Limitations of the Test
Typically, a web application only listens for requests locally, and external requests are forwarded to the application via a reverse proxy (e.g., nginx or HAProxy).
However, the check only verifies the last connection to the BPC. Since a reverse proxy is an external component, the BPC cannot verify here whether it only allows encrypted connections. You should therefore also ensure that any reverse proxies in use only allow encrypted connections. Further information can be found in the section on reverse proxies.
In addition, the HttpsBaseUrlCheck provides an indicator of whether external connections are encrypted.
