title: Unexpected results when attempting to access Tomcat 6 HTTPS connector using HTTP
body: <p>I configured an instance of Tomcat following this article: <a href="http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html" rel="nofollow">http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html</a>. I commented out HTTP connector because I want my demo application to be accessible only via HTTPS. I configured HTTPS connector as such:</p>
  
  <pre><code>   &lt;Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
             maxThreads="150" scheme="https" secure="true"
             clientAuth="false" sslProtocol="TLS" keystorePass="nopass"
             keystoreFile="/home/someuser/.keystore" keyAlias="tomcat" /&gt;
  </code></pre>
  
  <p>Everything works fine when I hit the URL of the my demo application's servlet using HTTPS.</p>
  
  <p>When I tried to hit it using HTTP URL, I expected it to return 403 or similar error. Instead I got download of some small (11 bytes?) binary file with the name matching the name of the servlet.</p>
  
  <p>Did anyone experienced similar issue? How did you resolve it? What should I check to make sure I did everything right?</p>
  
  <p><strong>EDIT:</strong> I tried hitting the same connector using curl instead of the browser and noticed that it doesn't return any headers. Oh, and the size of the response is 7 bytes, not 11.</p>
  
  <p><strong>EDIT 2:</strong> This is the security-related part of the web.xml of my demo application:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Secure Servlet&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/SecureServlet&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;connect&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;security-role&gt;
      &lt;description&gt;The role required to connect to the application
      &lt;/description&gt;
      &lt;role-name&gt;connect&lt;/role-name&gt;
  &lt;/security-role&gt;
  
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
  &lt;/login-config&gt;
  </code></pre>