A key customer in South China recently asked us a question that is related to apps manager . In app manager, there is a link for each individual app, user could click this link to access the app . Most of the time the link is in HTTPS protocol. But for some shared domain, it could be HTTP . After clicking the link, an unsecured warning may appears to notify the user that https is unsafe if the link is with protocol HTTP. User may be confused with this message and start worrying about the system security. So the question is: could we switch HTTPS to HTTP for the link inside apps manager?

Apps Manager

View Only

How to replace the app link with protocol https to HTTP in apps manager?

Bin Ju posted Jul 16, 2018 06:14 AM

A key customer in South China recently asked us a question that is related to apps manager .

In app manager, there is a link for each individual app, user could click this link to access the app . Most of the time the link is in HTTPS protocol. But for some shared domain, it could be HTTP .

After clicking the link, an unsecured warning may appears to notify the user that https is unsafe if the link is with protocol HTTP. User may be confused with this message and start worrying about the system security.

So the question is: could we switch HTTPS to HTTP for the link inside apps manager?

Stephen Carter posted Jul 16, 2018 10:07 AM

Hi Bin,

Apps Manager will provide HTTPS link for system and the default domain. For Shared Domains it will provide HTTP links.

There is a checkbox "Disable HTTP on HAProxy and Gorouter" in the Networking section of the PAS tile.

https://docs.pivotal.io/pivotalcf/2-2/customizing/config-er-vmware.html

This parameter disables the Gorouter and HAproxy from accepting HTTP requests.

And it also forces Apps Manager to display all URLs as HTTPS.

This assumes you want to completely disable HTTP traffic and only allow HTTPS. I would recommend testing this in dev environment first just in case you see any unexpected behavior.

Kind regards,

Stephen

Bin Ju posted Jul 16, 2018 10:19 AM

Hi Stephen,

Thanks for your comment!

Actually the user want HTTP instead of HTTPS.

In this on premises environment, SSL validation was skipped. That's why we have unsecured warning on browser.

Users found shared domains are looking very good - no warning related to security.

That is why they asked whether we could configure to make HTTP instead of HTTPS.

Stephen Carter posted Jul 16, 2018 10:36 AM

The current logic in Apps Manager is:

System/Default Domains or "Disable HTTP" selected then HTTPS URLs displayed
Shared Domains then HTTP URLs displayed

There is no option I'm aware of to force HTTP URLs to be displayed in Apps Manager.

The functionality you want would probably have to be a feature request.

But I would also be concerned about using HTTP.

We should be using HTTPS as much as possible to provide more security.

Bin Ju posted Jul 16, 2018 12:01 PM

You are correct! HTTP would not be a proper solution for eliminating warning shown on browser. I am going to talk with this customer again.

Thanks for your help!