title: How to force redirect to HTTPS when application has no web.xml
body: <p>I'm developing a web application using Servlet 3.x and I do not have web.xml instead I use the configuration annotation. I want to restrict all traffic to my application thats deployed in Openshift to be HTTPS. I found this article on how to do it in Tomcat(Jboss EWS). </p>
  
  <p><a href="https://help.openshift.com/hc/en-us/articles/202398810-How-to-redirect-traffic-to-HTTPS-" rel="nofollow">https://help.openshift.com/hc/en-us/articles/202398810-How-to-redirect-traffic-to-HTTPS-</a></p>
  
  <p>However the last step involves me changing the web.xml which I do not have. When I tried to find alternatives I could find articles on Servlet security. Can someone help me with the translation for this code snippet below?</p>
  
  <pre><code>A sample security-constraint directive in repo/src/main/webapp/WEB-INF/web.xml looks like:
  
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>