2

I am needing to enable SSL on an application hosted through Tomcat6 and I have added the following to the tomcat web.xml:

<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

and setup the redirectPort as 443, in server.xml - this setup works fine.

I am needing to allow access to the application, without requiring SSL, when the app is accessed using a specific dns name.

For example:

the SSL certificate for the application is associated with the DNS name

xyz.applicationdomain.com

when the application is accessed with this name, a redirect occurs, and the URL changes to

https://xyz.applicationdomain.com

but when the application is accessed with

abc.applicationdomain.com, the application needs to be accessible without requiring SSL.

is it possible to implement this using another security-constraint definition?

Improve this question
2
  • NO, security constraints in web.xml only considers the context, not the domain. You would need handle this I would think with a reverse proxy solution usiong apache or similar. Two seperate virtual hosts would redirect to either the secure port 8443, or the insecure port 8080 of the tomcat container.
    – Eddie
    Commented May 12, 2012 at 12:22
  • I wouldn't worry too much about the security-constraint aspect. It's useful to a degree, but the redirection it entails happens too late for actually securing the connection. Never rely on automatic redirections to switch to HTTPS: it's should be done with links (and be expected by the user).
    – Bruno
    Commented May 15, 2012 at 12:55

1 Answer 1

Reset to default
1

NO, security constraints in web.xml only considers the context, not the domain. You would need handle this I would think with a reverse proxy solution usiong apache or similar. Two seperate virtual hosts would redirect to either the secure port 8443, or the insecure port 8080 of the tomcat container.

Each context in server.xml would define the appropriate porxyhost and port to keep urls consistnet.

http://wiki.customware.net/repository/display/GREENHOUSE/2009/06/13/Reverse+Proxy+with+Apache+mod_proxy

Improve this answer
1
  • essentially, this means that tomcat should (1) not be setup to do the redirect from http to https (2) be setup to listen on 8080 and 8443 - and use a reverse proxy solution to redirect traffic to 80 or 443 as needed for each incoming request URL - correct?
    – user57555
    Commented May 13, 2012 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.