• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Jeanne Boyarsky
  • Ron McLeod
  • Paul Clapham
  • Liutauras Vilda
Sheriffs:
  • paul wheaton
  • Rob Spoor
  • Devaka Cooray
Saloon Keepers:
  • Stephan van Hulst
  • Tim Holloway
  • Carey Brown
  • Frits Walraven
  • Tim Moores
Bartenders:
  • Mikalai Zaikin

Secure login page only.

 
Ranch Hand
Posts: 93
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I have the following scenario and don't know how to implement it:
I have a login page which needs to be secure with SSL. Once the user is able to login, I don't want the subsequent pages to be secured anymore. How do I accomplish that.

TIA
 
Sheriff
Posts: 13411
Firefox Browser VI Editor Redhat
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Most containers, (Tomcat is one that I know of) will keep separate sessions for secure and non-secure sessions.
This is done for a good reason. In a non-secure session the sessionid cookie is passed over the web in clear text which opens your app up to session hijacking.

If your data is secure enough to require a secure login before accessing it, isn't it work keeping the session under SSL? Why do you want to drop SSL? is it for performance reasons? If so, have you tested to see exactly how much faster your app runs without SSL than with it?
 
reply
    Bookmark Topic Watch Topic
  • New Topic