| Author |
SSL - does it encrypt what is being sent to and from client?
|
protik ahmed
Greenhorn
Joined: Mar 21, 2010
Posts: 15
|
|
I know it sounds like a n00b question, but I haven't actually found a definitive answer. Will doing this actually provide encryption, say for example when logging in to a website. Will it encrypt the login username and password being sent to the server?
I'm using this guide:
http://tomcat.apache.org/tomcat-4.1-doc/ssl-howto.html
|
 |
Bear Bibeault
Author and opinionated walrus
Marshal
Joined: Jan 10, 2002
Posts: 50691
|
|
|
Yes.
|
[Smart Questions] [JSP FAQ] [Books by Bear] [Bear's FrontMan] [About Bear]
|
 |
Tim Holloway
Saloon Keeper
Joined: Jun 25, 2001
Posts: 12513
|
|
Longer answer: If you send a request to the SSL port of Tomcat and the webapp's configured to receive the request there, everything gets encrypted end-to-end. All the way down, all the way back. Since HTTP is stateless, however, each request/response stands on its own merits as to whether or not encryption will occur. If you don't ask for it, you don' get it. Although asking for a protected resource using non-SSL transport will be rejected.
What this means is that user IDs and passwords are only encrypted if the login request itself is made via SSL. If you're using container-managed security, that's ensured, but I have known people who used Do-It-Yourself security forget about that little detail. And send the credentials down in plain text.
One reason form-based authentication is so popular is that the alternative pop-up dialog login likes to "encrypt" with base-64, and that's to say essentially no encryption at all.
|
One of the most odious afflictions that Business has inflicted on the modern English language is "pro-active". Most of the time it's simply redundantly used in place of the simple old word "active". And a good deal of the rest of the time it means "You're not overworked enough yet, so go out and find more!"
|
 |
protik ahmed
Greenhorn
Joined: Mar 21, 2010
Posts: 15
|
|
|
Sorry to bother you guys again, just to clarify my situation. My java classes aren't set up for any kind of security at all. Website sends data to the servlets. All I have done is follow that guide, used the keytool to create a certificate. When I browse to the website usign the https://...:<port> there is a padlock on teh bottom right hand corner. Is the data encrypted? I know you put a long answer before, but I didn't make myself clear on the classes I have.
|
 |
Bear Bibeault
Author and opinionated walrus
Marshal
Joined: Jan 10, 2002
Posts: 50691
|
|
|
Yes.
|
 |
protik ahmed
Greenhorn
Joined: Mar 21, 2010
Posts: 15
|
|
Lol
cheers
|
 |
 |
|
|
subject: SSL - does it encrypt what is being sent to and from client?
|
|
|