Switching from HTTPS back to HTTP

[Michael Remijan]

Using security constraints in the web.xml, I know how to automatically swtich from HTTP to HTTPS if a user goes to a resource in a non-secure way which needs to be secure. An obvious example of this is a user login page. See the snippet from web.xml below. This snippet will automatically redirect the browser to HTTPS for any resources in /admin/public/*

     <security-constraint>
        <web-resource-collection>
            <web-resource-name>SecureAdminLogin</web-resource-name>
            <url-pattern>/admin/public/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
 
        <user-data-constraint>
            <description>
                Constrain the user data transport for the 
                administrator login. Https is used
                even if the original request came over http.
            </description>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

Now, however, after the user is logged in I want to switch out of HTTPS and back to regular old HTTP. I tried putting in a new security constraint with transport-guarantee = NONE but this didn't work. Any suggestions?

[Alessandro Ilardo]

have look:
link