The moose likes Tomcat and the fly likes SSL - does it encrypt what is being sent to and from client? Big Moose Saloon
  Search | Java FAQ | Recent Topics
Register / Login


JavaRanch » Java Forums » Products » Tomcat
Reply Bookmark "SSL - does it encrypt what is being sent to and from client?" Watch "SSL - does it encrypt what is being sent to and from client?" New topic
Author

SSL - does it encrypt what is being sent to and from client?

protik ahmed
Greenhorn

Joined: Mar 21, 2010
Posts: 15
I know it sounds like a n00b question, but I haven't actually found a definitive answer. Will doing this actually provide encryption, say for example when logging in to a website. Will it encrypt the login username and password being sent to the server?

I'm using this guide:
http://tomcat.apache.org/tomcat-4.1-doc/ssl-howto.html

This message was edited 1 time. Last update was at by protik ahmed

Bear Bibeault
Author and opinionated walrus
Marshal

Joined: Jan 10, 2002
Posts: 48842

Yes.


[Smart Questions] [JSP FAQ] [Books by Bear] [Bear's FrontMan] [About Bear]
Tim Holloway
Saloon Keeper

Joined: Jun 25, 2001
Posts: 11740

Longer answer: If you send a request to the SSL port of Tomcat and the webapp's configured to receive the request there, everything gets encrypted end-to-end. All the way down, all the way back. Since HTTP is stateless, however, each request/response stands on its own merits as to whether or not encryption will occur. If you don't ask for it, you don' get it. Although asking for a protected resource using non-SSL transport will be rejected.

What this means is that user IDs and passwords are only encrypted if the login request itself is made via SSL. If you're using container-managed security, that's ensured, but I have known people who used Do-It-Yourself security forget about that little detail. And send the credentials down in plain text.

One reason form-based authentication is so popular is that the alternative pop-up dialog login likes to "encrypt" with base-64, and that's to say essentially no encryption at all.


A lot the of modern-day software development platforms are designed to permit parcelling out work to those with the best aptitude for it. A lot of modern-day business is predicated on making one person do all the work, regardless of aptitude.
protik ahmed
Greenhorn

Joined: Mar 21, 2010
Posts: 15
Sorry to bother you guys again, just to clarify my situation. My java classes aren't set up for any kind of security at all. Website sends data to the servlets. All I have done is follow that guide, used the keytool to create a certificate. When I browse to the website usign the https://...:<port>; there is a padlock on teh bottom right hand corner. Is the data encrypted? I know you put a long answer before, but I didn't make myself clear on the classes I have.
Bear Bibeault
Author and opinionated walrus
Marshal

Joined: Jan 10, 2002
Posts: 48842

Yes.
protik ahmed
Greenhorn

Joined: Mar 21, 2010
Posts: 15
Lol

cheers
 
 
subject: SSL - does it encrypt what is being sent to and from client?
 
developer file tools

cast iron skillet 49er

more from paul wheaton's glorious empire of web junk: cast iron skillet diatomaceous earth rocket mass heater sepp holzer raised garden beds raising chickens lawn care CFL flea control missoula heat permaculture