Enforce TLS when HTTPS Mode is enabled

[DigitalDJ]

A note for the community

Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.

Disclaimer

• I have read and understood the disclaimer.
• I plan to implement the feature myself.

Subsystem

{"UI" => "Application"}

Feature description

Currently, when HTTPS mode is enabled, the server still responds normally via HTTP.

It is preferred that there is an option to redirect all HTTP requests to HTTPS to prevent any credential or token leakage.

This would help prevent any MITM attacks, both via sniffing traffic or downgrading HTTPS to HTTP.

Currently, the initial login sends the login password in plaintext in a POST request. This is easily obtainable without the use of TLS.

Combined with HSTS headers, this would force browsers to always connect to the JetKVM securely when a user accesses the host via plain HTTP.