1 Reply Latest reply on Feb 19, 2007 10:49 AM by eric es


    Ashwin Gopalakrishnan Newbie

      I am a student developing a j2ee application using jboss application server. I want to use https instead of http for more security. I have created a sample keystore and configured both jboss-service.xml and service.xml inside tomcat.sar. Https works fine but i am also able to access using http. I want to access exclusively using https ie even if the URL contains http it should automatically redirect to https.

        • 1. Re: https
          eric es Newbie

          you can use a <security-constraint> tag in your web.xml to enforce https connections:

          -- snip --
          -- snip --

          the <user-data-constraint> here does the trick with <transport-guarantee> set to CONFIDENTIAL. It'll try to switch to https automaticly now when accessing anything behind /secure on the server. Note this example required the user to have the "manager" role and this requires some more configuration (login config etc).