Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I am needing to enable SSL on an application hosted through Tomcat6 and I have added the following to the tomcat web.xml:

<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

and setup the redirectPort as 443, in server.xml - this setup works fine.

I am needing to allow access to the application, without requiring SSL, when the app is accessed using a specific dns name.

For example:

the SSL certificate for the application is associated with the DNS name

xyz.applicationdomain.com

when the application is accessed with this name, a redirect occurs, and the URL changes to

https://xyz.applicationdomain.com

but when the application is accessed with

abc.applicationdomain.com, the application needs to be accessible without requiring SSL.

is it possible to implement this using another security-constraint definition?

share|improve this question
    
NO, security constraints in web.xml only considers the context, not the domain. You would need handle this I would think with a reverse proxy solution usiong apache or similar. Two seperate virtual hosts would redirect to either the secure port 8443, or the insecure port 8080 of the tomcat container. –  Eddie May 12 '12 at 12:22
    
I wouldn't worry too much about the security-constraint aspect. It's useful to a degree, but the redirection it entails happens too late for actually securing the connection. Never rely on automatic redirections to switch to HTTPS: it's should be done with links (and be expected by the user). –  Bruno May 15 '12 at 12:55

1 Answer 1

up vote 1 down vote accepted

NO, security constraints in web.xml only considers the context, not the domain. You would need handle this I would think with a reverse proxy solution usiong apache or similar. Two seperate virtual hosts would redirect to either the secure port 8443, or the insecure port 8080 of the tomcat container.

Each context in server.xml would define the appropriate porxyhost and port to keep urls consistnet.

http://wiki.customware.net/repository/display/GREENHOUSE/2009/06/13/Reverse+Proxy+with+Apache+mod_proxy

share|improve this answer
    
essentially, this means that tomcat should (1) not be setup to do the redirect from http to https (2) be setup to listen on 8080 and 8443 - and use a reverse proxy solution to redirect traffic to 80 or 443 as needed for each incoming request URL - correct? –  user57555 May 13 '12 at 20:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.