File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Tomcat and the fly likes SSL - does it encrypt what is being sent to and from client? Big Moose Saloon
  Search | Java FAQ | Recent Topics
Register / Login
JavaRanch » Java Forums » Products » Tomcat
Reply Bookmark "SSL - does it encrypt what is being sent to and from client?" Watch "SSL - does it encrypt what is being sent to and from client?" New topic
Author

SSL - does it encrypt what is being sent to and from client?

protik ahmed
Greenhorn

Joined: Mar 21, 2010
Posts: 15
I know it sounds like a n00b question, but I haven't actually found a definitive answer. Will doing this actually provide encryption, say for example when logging in to a website. Will it encrypt the login username and password being sent to the server?

I'm using this guide:
http://tomcat.apache.org/tomcat-4.1-doc/ssl-howto.html
Bear Bibeault
Author and opinionated walrus
Marshal

Joined: Jan 10, 2002
Posts: 50691

Yes.


[Smart Questions] [JSP FAQ] [Books by Bear] [Bear's FrontMan] [About Bear]
Tim Holloway
Saloon Keeper

Joined: Jun 25, 2001
Posts: 12513

Longer answer: If you send a request to the SSL port of Tomcat and the webapp's configured to receive the request there, everything gets encrypted end-to-end. All the way down, all the way back. Since HTTP is stateless, however, each request/response stands on its own merits as to whether or not encryption will occur. If you don't ask for it, you don' get it. Although asking for a protected resource using non-SSL transport will be rejected.

What this means is that user IDs and passwords are only encrypted if the login request itself is made via SSL. If you're using container-managed security, that's ensured, but I have known people who used Do-It-Yourself security forget about that little detail. And send the credentials down in plain text.

One reason form-based authentication is so popular is that the alternative pop-up dialog login likes to "encrypt" with base-64, and that's to say essentially no encryption at all.


One of the most odious afflictions that Business has inflicted on the modern English language is "pro-active". Most of the time it's simply redundantly used in place of the simple old word "active". And a good deal of the rest of the time it means "You're not overworked enough yet, so go out and find more!"
protik ahmed
Greenhorn

Joined: Mar 21, 2010
Posts: 15
Sorry to bother you guys again, just to clarify my situation. My java classes aren't set up for any kind of security at all. Website sends data to the servlets. All I have done is follow that guide, used the keytool to create a certificate. When I browse to the website usign the https://...:<port>; there is a padlock on teh bottom right hand corner. Is the data encrypted? I know you put a long answer before, but I didn't make myself clear on the classes I have.
Bear Bibeault
Author and opinionated walrus
Marshal

Joined: Jan 10, 2002
Posts: 50691

Yes.
protik ahmed
Greenhorn

Joined: Mar 21, 2010
Posts: 15
Lol

cheers
 
 
subject: SSL - does it encrypt what is being sent to and from client?
 
Threads others viewed
database keys in JSP form
Encrypt Password/userid on the client side before being sent to server.
Core Security patterns book for J2EE
SSL session
What does HTTPS(SSL) encrypt? Message Data or header info?
IntelliJ Java IDE