[Help]: After 5.15.20.16 controller is always redirecting to https

[tokenize47]

Controller Version

5.15.20.16

Describe Your Issue or Question

The title says all. I've always used http to access the controller page in my LAN. After the update to 5.15.20.16 it always redirects to https. It's not really an issue, but a bit annoying that I have to accept the security exception and I'm curious what could have changed.

Expected Behavior

No https redirection

Steps to Reproduce

Open your controller url with http://ip:http_port and watch it being auto redirected to https://ip:https_port

How You're Launching the Container

docker run -d \
  --name=omada \
  --stop-timeout 60 \
  --restart=unless-stopped \
  --net=host \
  --ulimit nofile=4096:8192 \
  -e TZ=****\
  -v ****:/opt/tplink/EAPController/data \
  -v ****:/opt/tplink/EAPController/logs \
  mbentley/omada-controller

Container Logs

Not applicable

MongoDB Logs

No response

Additional Context

Not really an issue, but it's intriguing and annoying

[tokenize47]

I just noticed in the beta changelog that they forced this. I don't see any need for this in a local network, so is there any way to disable it?

[pixielark]

I have the same issue

[mbentley]

I would say that your best bet is to complain on the TP-Link forums. When they blocked being able to use ports 1-1024, I stated my case and they reversed their change so it's worth a shot. I don't see why they wouldn't default to not allowing http but still have the toggle.

[sofiaurora270]

I added a threaf about this: https://community.tp-link.com/en/business/forum/topic/782912?page=1

[srwareham]

Just to consolidate some of the information above:
TP-Link published SDN Controller V5.15.20.X. Within the release notes they have "Bugs Fixed: Reduced potential security risks by forcibly redirecting HTTP requests and responses to HTTPS ones." This change seems to ignore the "Redirect HTTP to HTTPS" setting that is still present... This effectively means you can no longer do your own SSL termination by reverse proxying to an HTTP service.

sofiaurora created this community forum request to revert the change. You can upvote/comment to try to show TP-Link this is not a good change.

In the meantime, running the older release with image: mbentley/omada-controller:5.15.20.16 will still work with HTTP.

[tokenize47]

The option "Redirect HTTP to HTTPS" applies to the Portal only, not the controller. They effectively hard coded this change.

[sofiaurora270]

In the meantime, i've now added "--serverstransport.insecureskipverify=true" to my traefik configuration, and forwarded requests to 8043 port. Not happy about the change, but at least it wasn't that hard to overcome.