apache http https redirect server still listenting on port 80

Question

I have an application that is using Apache. I have install the mod_ssl module for Apache, configured an SSL certificate and because the application provides such function configured http to https redirects but the server still is listening on port 80 (on 443 as well). Is this a security concern?

Answer 1

It depends on the specific setup if this is a security concern or not. If any access to port 80 only results in a plain redirect to the https:// site on port 443 with no cookies set (or at least no sensitive cookies) then there should be no security concern. If instead it is possible to reach different actions by accessing some page within the plain http:// site or if the redirect to https:// already sets a sensitive session cookie or similar then there is a problem since this cookie is transferred unprotected.

Answer 2

No - this is just Apache behaving as told.

Apache can't redirect from http to https except by listening for http requests on port 80. @Steffen Ulrich's answer gives some more hints on verifying everything is on the up-and-up, but I see no reason to suspect this is anything more than Apache doing exactly what it is supposed to do.

If Apache wasn't listening on port 80 you wouldn't get your redirect - instead you would get no response at all and a site that appears broken.