Careeroza

HTTPS

Why HTTPS Is Mandatory

HTTP Basic sends the password in every request, and a session cookie is as good as a password. Over plain HTTP anyone on the same Wi-Fi, ISP or proxy can read them. HTTPS (HTTP over TLS) encrypts the whole request and proves the server is really shopease.in using a certificate.

  • Confidentiality: passwords, cookies and card details are encrypted.
  • Integrity: nobody can modify the response (inject ads or scripts).
  • Authenticity: the certificate proves the server identity.

Where TLS Usually Ends

Browser --HTTPS--> Load balancer / Nginx (certificate here, e.g. Let's Encrypt)
                         |
                         +--HTTP (private network)--> Spring Boot :8080

In production, TLS is usually handled by a load balancer, Nginx or the cloud provider. Tell Spring Boot it is behind a proxy so it builds correct https:// redirect URLs:

server.forward-headers-strategy=framework

HTTPS Directly in Spring Boot

Example

For a local test you can create a self-signed certificate with the JDK keytool:

keytool -genkeypair -alias shopease -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore shopease.p12 -validity 365

Example output

Enter keystore password: ********
What is your first and last name?
  [Unknown]:  localhost
...

Configuration

application.yml

server:
  port: 8443
  ssl:
    key-store: classpath:shopease.p12
    key-store-password: ${KEYSTORE_PASSWORD}
    key-store-type: PKCS12
    key-alias: shopease

Tip: Spring Security adds the Strict-Transport-Security (HSTS) header on HTTPS responses, telling browsers to always use HTTPS for your site.