Tomcat session continuation from https to http

[Bob Feretich <bo...@prodigy.net>]

The Tomcat code distinguishes between http and https accesses, with
respect to session continuation. Specifically, when
HttpServeletResponse.encodeRedirectURL(} or
HttpServeletResponse.encodeURL() are called for URL rewriting (client
has cookies turned off), if the current servlet is accessed via https
and the new URL is accessed via http (or visa versa)
HttpResponseBase.isEncodeable(} determines that the sessionId should not
be appended to the URL, causing session continuity to be lost. Why?

My web application has mostly non-secure pages, but some pages need SSL
security. I would like to avoid the SSL overhead on non-secure pages.
However, my client sessions must span access to both types of pages. How
am I to do this with Tomcat? (The latest level of Tomcat my hosting
service supports is Tomcat 4.1.24.)

I have noticed, that with cookies turned on, there is no problem
maintaining the session.

Regards,
Bob Feretich




---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org