I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant that http or https would work on URLs for that web application.
Recently this was seen as a security risk and http is no longer being advertised. For users this has caused an issue where all the links they had which were originally http no longer work and they are having to update all their links to https.
I can't quite figure out what the vulnerability is, and if someone could shed some knowledge I would really appreciate it.
How I understand it, there are 2 paths http and https. The TMG server essentially acts as the gatekeeper that sits in front of the organisations network and forces all http traffic down the https route instead, so at no point is there any http traffic into the network.
Also, to add plenty of well recognised organisations still use port forwarding, for example Microsoft teams http:// teams.microsoft.com auto redirects to https:// teams.microsoft.com. Unless they are using a different method of redirect that is more secure?
Thanks in advance