1 Reply Latest reply on Feb 19, 2007 10:49 AM by eric es

    https

    Ashwin Gopalakrishnan Newbie

      I am a student developing a j2ee application using jboss application server. I want to use https instead of http for more security. I have created a sample keystore and configured both jboss-service.xml and service.xml inside tomcat.sar. Https works fine but i am also able to access using http. I want to access exclusively using https ie even if the URL contains http it should automatically redirect to https.

        • 1. Re: https
          eric es Newbie

          you can use a <security-constraint> tag in your web.xml to enforce https connections:

          -- snip --
           <security-constraint>
           <display-name>manager_access</display-name>
           <web-resource-collection>
           <web-resource-name>manager_pages</web-resource-name>
           <description/>
           <url-pattern>/secure/*</url-pattern>
           <http-method>GET</http-method>
           <http-method>POST</http-method>
           <http-method>HEAD</http-method>
           <http-method>PUT</http-method>
           <http-method>OPTIONS</http-method>
           <http-method>TRACE</http-method>
           <http-method>DELETE</http-method>
           </web-resource-collection>
           <auth-constraint>
           <description/>
           <role-name>manager</role-name>
           </auth-constraint>
           <user-data-constraint>
           <description/>
           <transport-guarantee>CONFIDENTIAL</transport-guarantee>
           </user-data-constraint>
           </security-constraint>
          -- snip --
          

          the <user-data-constraint> here does the trick with <transport-guarantee> set to CONFIDENTIAL. It'll try to switch to https automaticly now when accessing anything behind /secure on the server. Note this example required the user to have the "manager" role and this requires some more configuration (login config etc).