How to Determine if a Java Servlet Request Was Made Using HTTP or HTTPS?

How can I check if my Java servlet request was made using HTTP or HTTPS?

// Example code to check request protocol
String protocol = request.getHeader("X-Forwarded-Proto");
if (protocol != null && protocol.equals("https")) {
    // Request was made using HTTPS
} else {
    // Request was made using HTTP
}

To determine whether a request to a Java servlet was made using HTTP or HTTPS, you need to inspect specific headers associated with the request. The method `request.getProtocol()` will often return `HTTP/1.1` for both HTTP and HTTPS requests, so alternative methods must be employed.

if (request.isSecure()) {
    // Handle HTTPS request
} else {
    // Handle HTTP request
}

Causes

• Using request.getProtocol() returns HTTP/1.1 for both HTTP and HTTPS as the protocol does not distinguish between them explicitly in certain configurations.
• Some server configurations may not send the expected protocol information via standard headers.

Solutions

• Use the request.getHeader("X-Forwarded-Proto") method to check for the protocol. This works well in reverse proxy setups.
• Alternatively, check request.isSecure() method which returns true if the request was made using HTTPS, allowing for a simple conditional check.

Mistake: Relying solely on request.getProtocol().

Solution: Combining request.getHeader("X-Forwarded-Proto") and request.isSecure() for better accuracy.

Mistake: Assuming all deployments will have the same configuration for forwarded headers.

Solution: Check server and proxy configurations.