SSL - does it encrypt what is being sent to and from client?
protik ahmed
Greenhorn
Joined: Mar 21, 2010
Posts: 15
posted
0
I know it sounds like a n00b question, but I haven't actually found a definitive answer. Will doing this actually provide encryption, say for example when logging in to a website. Will it encrypt the login username and password being sent to the server?
Longer answer: If you send a request to the SSL port of Tomcat and the webapp's configured to receive the request there, everything gets encrypted end-to-end. All the way down, all the way back. Since HTTP is stateless, however, each request/response stands on its own merits as to whether or not encryption will occur. If you don't ask for it, you don' get it. Although asking for a protected resource using non-SSL transport will be rejected.
What this means is that user IDs and passwords are only encrypted if the login request itself is made via SSL. If you're using container-managed security, that's ensured, but I have known people who used Do-It-Yourself security forget about that little detail. And send the credentials down in plain text.
One reason form-based authentication is so popular is that the alternative pop-up dialog login likes to "encrypt" with base-64, and that's to say essentially no encryption at all.
A lot the of modern-day software development platforms are designed to permit parcelling out work to those with the best aptitude for it. A lot of modern-day business is predicated on making one person do all the work, regardless of aptitude.
protik ahmed
Greenhorn
Joined: Mar 21, 2010
Posts: 15
posted
0
Sorry to bother you guys again, just to clarify my situation. My java classes aren't set up for any kind of security at all. Website sends data to the servlets. All I have done is follow that guide, used the keytool to create a certificate. When I browse to the website usign the https://...:<port> there is a padlock on teh bottom right hand corner. Is the data encrypted? I know you put a long answer before, but I didn't make myself clear on the classes I have.
Bear Bibeault
Author and opinionated walrus
Marshal