I am considering using both HTTP and HTTPS in a web application and I am looking for tips to accomplish this best. The application will run under Tomcat.

I have also seen the following about HTTPS performance. Can anyone confirm the claims made in this post (i.e., SSL/TLS is not computationally expensive any more)? Do you agree?


  • I believe the claims in the link but I would still do my own testing to verify or refute them. As @Andrew Finnell notes below, it is a claim, not a proof. – President James K. Polk Dec 27 '10 at 2:16

I would say that if you have sensitive information passed in your app, you must have HTTPS regardless of the computational expense. If my bank didn't have HTTPS turned on from the moment I logged on I wouldn't use them. Security trumps performance when it's absolutely needed.


That article makes a claim and doesn't back it up. While they can say it isn't computationally expensive COMPARED to 10 years ago, computationally expensive is relative. I believe their assertion is based on the fact that if you are using HTTP(S) in general for communication that adding SSL/TLS on top of that communication mechanism isn't going to destroy the performance of your application. I would rather see some profiling of an example first before believing that though.

We need to understand the type of application you are developing first. Is this an application that will be transporting data through public networks? If it is through public networks will it require a VPN to access thus potentially providing encryption at the VPN layer?

How many HTTP operations per second are you expecting?

You will need to run performance tests to determine if SSL/TLS adds any overhead to your application. Build your application to handle both.

What are the Use Cases for allowing someone to pick HTTPS over HTTP? If all the data is sensitive and some users would want HTTPS, I would question even allowing HTTP communication in the system.

  • The motivation for HTTPS is mostly to make sure identity is not stolen between server and remote client. It would be used for login purposes mostly. The remaining information is not highly valuable and could be transferred over HTTP. – JVerstry Dec 26 '10 at 18:31
  • This information is not conveyed in your original question thus my response does not deserve a negative remark. HTTPS is not always used in this major and is most often used to verify the server is trustworthy and then to encrypt the information being passed such as in CC transaction or sensitive document transfers. I would suggest appending to your original question that you are only using Certificates to authenticate your client/servers. – Andrew Finnell Dec 26 '10 at 20:47
  • Actually, they do offer proof: the fact that switching from HTTP to HTTPS did not require additional hardware, and the fact that TLS accounts for less than 1% of CPU load, 10KB of memory, and 2% of network overhead per connection. – Lèse majesté Dec 27 '10 at 5:17

The idea is not to mix "public" HTTP with "private" HTTPS. Use HTTP whenever there is no problem if someone intercept your communication with the user, and when the communication gets private (sensitive data will tell you when) then use HTTPS. Don't mix them, because one thing that is considered a vulnerability is to have both services pointing to the same root folder.

Let me explain myself better: If anyone can hurt your server using the HTTP protocol, by example locating a file in one of your folders, he will automatically knows that this damage is affecting the HTTPS site too.

Be smart, don't show your cards.


Best way is to use redirects (301) to ensure visitors are only using the desired protocol on a particular url. If you have Apache (with mod rewrite) or IIS running in front of Tomcat its easy, otherwise its a bit trickier. If you are running Tomcat standalone you can write a filter to do the redirecting. There are also some general rewrite filters already written out there, but I'm not sure which ones are any good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.