How to force Jira to redirect requests to the load balancer or reverse-proxy using Tomcat
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
One popular requirement is to prevent users to make requests directly to the application servers, bypassing the frontend load balancer or reverse-proxy.
There is a multitude of ways to achieve this, such as using network restrictions or web server rewrite rules.
This article describes how to use a Tomcat configuration to make Jira redirect the users to the frontend URL on every redirect, such as the one that happens on logon. This does not prevent users from making access to the nodes directly, and should not be viewed as a security measure - it's more of a way to decrease access to nodes than prevent it.
Environment
This assumes that the load balancer or reverse proxy is already configured in the environment and working as expected. If not, please refer to these articles for guidance and examples:
Solution
By default, Tomcat redirects users in a relative manner, but we can configure it to use absolute paths.
Open the
jira-install/conf/server.xmlfile.Add the useRelativeRedirects="false" parameter to the Context tag.
Your Jira tag will look like this:
1 2 3 4 5 6<Context path="" docBase="${catalina.home}/atlassian-jira" reloadable="false" useHttpOnly="true" useRelativeRedirects="false"> <Resource name="UserTransaction" auth="Container" type="javax.transaction.UserTransaction" factory="org.objectweb.jotm.UserTransactionFactory" jotm.timeout="60"/> <Manager pathname=""/> <JarScanner scanManifest="false"/> <Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="120" /> </Context>Restart the Jira application.
For more details about this configuration, check https://tomcat.apache.org/tomcat-8.5-doc/config/context.html.
Was this helpful?