I am considering using both HTTP and HTTPS in a web application and I am looking for tips to accomplish this best. The application will run under Tomcat.
I have also seen the following about HTTPS performance. Can anyone confirm the claims made in this post (i.e., SSL/TLS is not computationally expensive any more)? Do you agree?
Thanks!
I would say that if you have sensitive information passed in your app, you must have HTTPS regardless of the computational expense. If my bank didn't have HTTPS turned on from the moment I logged on I wouldn't use them. Security trumps performance when it's absolutely needed.
That article makes a claim and doesn't back it up. While they can say it isn't computationally expensive COMPARED to 10 years ago, computationally expensive is relative. I believe their assertion is based on the fact that if you are using HTTP(S) in general for communication that adding SSL/TLS on top of that communication mechanism isn't going to destroy the performance of your application. I would rather see some profiling of an example first before believing that though.
We need to understand the type of application you are developing first. Is this an application that will be transporting data through public networks? If it is through public networks will it require a VPN to access thus potentially providing encryption at the VPN layer?
How many HTTP operations per second are you expecting?
You will need to run performance tests to determine if SSL/TLS adds any overhead to your application. Build your application to handle both.
What are the Use Cases for allowing someone to pick HTTPS over HTTP? If all the data is sensitive and some users would want HTTPS, I would question even allowing HTTP communication in the system.
The idea is not to mix "public" HTTP with "private" HTTPS. Use HTTP whenever there is no problem if someone intercept your communication with the user, and when the communication gets private (sensitive data will tell you when) then use HTTPS. Don't mix them, because one thing that is considered a vulnerability is to have both services pointing to the same root folder.
Let me explain myself better: If anyone can hurt your server using the HTTP protocol, by example locating a file in one of your folders, he will automatically knows that this damage is affecting the HTTPS site too.
Be smart, don't show your cards.
Best way is to use redirects (301) to ensure visitors are only using the desired protocol on a particular url. If you have Apache (with mod rewrite) or IIS running in front of Tomcat its easy, otherwise its a bit trickier. If you are running Tomcat standalone you can write a filter to do the redirecting. There are also some general rewrite filters already written out there, but I'm not sure which ones are any good.
