It's easy to setup in container, however for some reason my servlet should do authentication. Is session cookie set as secure? If not it should work, right?
Session cookies are stored in the HTTP header and are encrypted, but if you're looking at a mixture of encrypted and non-encrypted traffic this won't matter. You will want to make sure the domain set in the cookie is the same for both the SSL and non-SSL traffic otherwise the user will be authenticated with a cookie valid for the SSL domain but the cookie will not be sent when they move to the non-SSL domain.
0
