M
Maik Wiege
Hello!
I have some questions about SSL in tomcat. My set up of the ssl port works
fine, but I have some problems about setting it up for selected pages...
Here is what I wrote in my web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>Security page
</web-resource-name>
<url-pattern>/test.jsp</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
Opening the test.jsp in my browser changes the connection to ssl mode, what
is fine, but following a link to any other page from there, lets the user
stay in ssl mode what I doesn't want.
I tried, to add this in the web.xml too, but it made no change...
<security-constraint>
<web-resource-collection>
<web-resource-name>Insecurity page
</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
Anybody an idea, how this is correctly implemented?
Thanks!
Maik
I have some questions about SSL in tomcat. My set up of the ssl port works
fine, but I have some problems about setting it up for selected pages...
Here is what I wrote in my web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>Security page
</web-resource-name>
<url-pattern>/test.jsp</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
Opening the test.jsp in my browser changes the connection to ssl mode, what
is fine, but following a link to any other page from there, lets the user
stay in ssl mode what I doesn't want.
I tried, to add this in the web.xml too, but it made no change...
<security-constraint>
<web-resource-collection>
<web-resource-name>Insecurity page
</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
Anybody an idea, how this is correctly implemented?
Thanks!
Maik