Win a copy of Escape Velocity: Better Metrics for Agile Teams this week in the Agile and Other Processes forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Liutauras Vilda
  • Tim Cooke
  • Paul Clapham
  • Jeanne Boyarsky
Sheriffs:
  • Ron McLeod
  • Frank Carver
  • Junilu Lacar
Saloon Keepers:
  • Stephan van Hulst
  • Tim Moores
  • Tim Holloway
  • Al Hobbs
  • Carey Brown
Bartenders:
  • Piet Souris
  • Frits Walraven
  • fred rosenberger

Tomcat filters

 
Ranch Hand
Posts: 146
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hi Guys,

Ive been doing some research and i discovered that the following code put in a web.xml will force Tomcat to redirect to a https connection for certain wildcard matches, or in the below case all pages in the domain.
My question is though if only a few pages below were added to the filter such as login page and account page, https is invoked when those pages are requested, but then tomcat keeps a https connection from that point on.
Is it possible to also have filters that force tomcat to redirect to a non ssl port for some pages that do not need securing.

So based on the url pattern, Tomcat will redirect to https and then back to http?




Best
Mark Hughes
 
Mark Hughes
Ranch Hand
Posts: 146
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hey Guys,

Any takers on this?
 
Rancher
Posts: 43028
76
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
No, that's not possible. But you can do that explicitly in the HTML by using absolute URLs starting with "http:". If you use relative URLs (which do not contain the protocol to use), then it's going to keep using HTTPS.
 
Saloon Keeper
Posts: 26057
186
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
By the time a web request gets to the Tomcat filter, it's already passed through the network and been decrypted. So a filter can't help.

Don't make the common mistake of thinking that a web session is a continuous conversation that you can switch. The underlying HTTP(S) protocol is strictly atomic, and it's only by generous use of smoke and mirrors that we make webapps appear to have a connection from one press of the Submit button to the next.

Part of that "smoke and mirrors" is the URL that makes the next request. And as Ulf said, you can control the protocol, server, and port by shaping the URL(s) that the server for the previous request sends back in links, resource references and form submit targets.
 
Mark Hughes
Ranch Hand
Posts: 146
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
cool thanks guys, that makes sense.

Best
Mark Hughes
 
Every snowflake is perfect and unique. And every snowflake contains a very tiny ad.
Garden Master Course kickstarter
https://coderanch.com/t/754577/Garden-Master-kickstarter
reply
    Bookmark Topic Watch Topic
  • New Topic