Question

I have a web service deployed on a server instance. On the same instance, we also have a webapp which consumes this web service and is a front-end to the end user.

Since both are on the same server instance and the communication is local, I was wondering whether or not using HTTPS will be an overhead?

Answer 1

Yes, in the same server HTTPS just adds overhead. Can communicate over HTTP

If the web service server instance is not exposed to outside world, you can completely disable HTTPS listener.

If this web service server is exposed to outside world, then you can write a filter in which redirects the http request coming from outside to https.

This is how the filter looks:

public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException
{
    HttpServletRequest httpRequest = (HttpServletRequest) servletRequest;
    HttpServletResponse httpResponse = (HttpServletResponse) servletResponse;        
    if(httpRequest.isSecure() || isHostAllowed(servletRequest.getRemoteHost()) ){
        filterChain.doFilter(servletRequest, servletResponse);
    } else{
        String url  = "https://"+servletRequest.getServerName() + "/" + httpRequest.getRequestURI();
        httpResponse.sendRedirect(url);
    }
}