How to turn off https once logged in?

[Marcelo Ortega]

I am using this:

<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>

for a login page, but once logged i want to turn off https.

Any idea?

p.s, i'm using tomcat as the web container.

[Ben Souther]

An absolute link starting with 'http://...." will do it.

Just be aware, Tomcat creates separate sessions for secure and non secure connections so you will loose your session when you do this. Also, most browsers will whine with a popup if you force the user out of a secure session to a non-secure one.

[Marcelo Ortega]

Thanks Ben.