switching between HTTP and HTTPS

[mutuah]

Hi all.

Am trying to create jsp pages where the login page runs on htts but the rest are on http protocol. How can i implement this. At least I know that the two protocols create different sessions.

I would also wish to know how to revert back to https from http. Thanks in advance.
Mutua.

[brianhks]

Your best bet is to use apache in front of tomcat (or whatever servlet container you are using) and use the apache java connector - I forget the name right now.

Apache is much better and configuring which URLs should be secure and which should not. This way the security is transparent to your jsp files.

[mutuah]

Thanks brianhks.

Am using tomcat and servlet container and have already configured the web.xml

<security-constraint>
<display-name>secure_pages</display-name>
<web-resource-collection>
<web-resource-name>index.jsp</web-resource-name>
<description/>
<url-pattern>/index.jsp</url-pattern>
</web-resource-collection>
<user-data-constraint>
<description/>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

but the problem is all pages become secured (https) contrary to my wish. I want the login page and later another page to be secured.

What I need is to switch between the https and http sessions.

[brianhks]

It is a lot easier to let Apache do it for you. The connector is modjk.

[mutuah]

Sorry brianhks to trouble you this far. I have set one page 'index.jsp' to an https. this 'index.jsp' is the first my page. After signing, all other pages are https but its not what i want.

[brianhks]

I think you have missed my point. What you do is forget about doing anything in https from tomcat. From tomcat every thing is in the clear. You install Apache in front of Tomcat so that Apache passes request through to Tomcat. Now from Apache it is easy to setup certain URL's to be https and other to not be https. This way from within Tomcat every thing is on the same session. Apache handles the switching which is what it is good at (and a bunch of other stuff too).

[mutuah]

Hi brianhks,
Am running my jsp pages on apache tomcat. The first page 'index.jsp' is the home page. I have set the web.xml for the page i need secured but seems the other pages too get secured contrary to my wish.

In the servlet, I have redirected by hard-coding the url page I need after the index page but I loose the session. How do I get the same session data in both HTTP and HTTPS?