You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Dave <ja...@yahoo.com> on 2008/02/01 08:45:41 UTC
How to use https together with http
For jsf page (myfaces), some data need to go through SSL such as bank information.
For better performance, other pages(or forms) can use http.
<h:form> ... </h:form>
<h:form> ... </h:form>
if a form may contain personal data, it should be summitted using https. Also we need to let user know it is secure by showing a lock and https://.... in browser address bar.
How can I do this?
sometimes The IE browser shows a warning: the page contains both secure and nonsecure data. what is the meaning? how to avoid the warning?
Thanks for ideas.
Dave
---------------------------------
Looking for last minute shopping deals? Find them fast with Yahoo! Search.
AW: How to use https together with http
Posted by René Günther <re...@innflow.com>.
* sometimes The IE browser shows a warning: the page contains both secure
and nonsecure data. what is the meaning? how to avoid the warning?
This happens if the source of some objects of the page (eg. Images,
javascript) is http://... and other the source of other objects is
https://...
Eg.
https://localhost/myPage.jsf got an image with source
http://localhost/images/logo.jpg
Regarding the other questions, you might have to use filters and servlets
for redirecting from http to https, but I am not sure about that.
Rene
Von: Dave [mailto:javaone9@yahoo.com]
Gesendet: Freitag, 1. Februar 2008 07:46
An: users@myfaces.apache.org; Tomcat Users List
Betreff: How to use https together with http
For jsf page (myfaces), some data need to go through SSL such as bank
information.
For better performance, other pages(or forms) can use http.
<h:form> ... </h:form>
<h:form> ... </h:form>
if a form may contain personal data, it should be summitted using https.
Also we need to let user know it is secure by showing a lock and
https://.... in browser address bar.
How can I do this?
<
sometimes The IE browser shows a warning: the page contains both secure and
nonsecure data. what is the meaning? how to avoid the warning?
Thanks for ideas.
Dave
_____
Looking for last minute shopping deals? Find
<http://us.rd.yahoo.com/evt=51734/*http:/tools.search.yahoo.com/newsearch/ca
tegory.php?category=shopping> them fast with Yahoo! Search.
Re: How to use https together with http
Posted by Andrew Robinson <an...@gmail.com>.
Note that when you switch you may lose your servlet session. Cookies built
in https are not visible to http. And using an http cookie in https is a
security hole.
On Feb 1, 2008 12:45 AM, Dave <ja...@yahoo.com> wrote:
> For jsf page (myfaces), some data need to go through SSL such as bank
> information.
> For better performance, other pages(or forms) can use http.
>
> <h:form> ... </h:form>
>
> <h:form> ... </h:form>
>
> if a form may contain personal data, it should be summitted using https.
> Also we need to let user know it is secure by showing a lock and
> https://.... in browser address bar.
>
> How can I do this?
>
> sometimes The IE browser shows a warning: the page contains both secure
> and nonsecure data. what is the meaning? how to avoid the warning?
>
> Thanks for ideas.
> Dave
>
> ------------------------------
> Looking for last minute shopping deals? Find them fast with Yahoo! Search.<http://us.rd.yahoo.com/evt=51734/*http://tools.search.yahoo.com/newsearch/category.php?category=shopping>
>
Re: How to use https together with http
Posted by David Brown <da...@davidwbrown.name>.
Yep, Konstantin is right. This is what I do with all of my public pages that I want secured. This means I https ALL pages without exception if I want it to be secure. The net is nasty. You may have performance issues but once your public server is breached you will have more issues. As I said before: JSF is slow. There are benchmarks using JMeter comparing like JSF and JSP pages. Read Peter Lin's work on performance. HTH.
Konstantin Kolinko wrote ..
> You cannot and must not show that your page is secure, because it is not.
>
> The problem is that your page is vulnerable to a man-in-the-middle
> attack: there is no guarantee that the text of your web page or of the
> javascript files that it is using was not altered by someone while it
> was transmitted from the server to your client.
>
> E.g. someone may implement a script that submits the copy of sensitive
> data to some other server, before submitting it through https to your
> server.
>
> The only way to claim that your page is secure is to serve it through https.
>
>
>
> 2008/2/1, Dave <ja...@yahoo.com>:
> > if a form may contain personal data, it should be summitted using https. Also
> we need to let user know it is secure by showing a lock and https://.... in browser
> address bar.
> >
> > sometimes The IE browser shows a warning: the page contains both secure and
> nonsecure data. what is the meaning? how to avoid the warning?
> >
> >
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to use https together with http
Posted by Konstantin Kolinko <kn...@gmail.com>.
You cannot and must not show that your page is secure, because it is not.
The problem is that your page is vulnerable to a man-in-the-middle
attack: there is no guarantee that the text of your web page or of the
javascript files that it is using was not altered by someone while it
was transmitted from the server to your client.
E.g. someone may implement a script that submits the copy of sensitive
data to some other server, before submitting it through https to your
server.
The only way to claim that your page is secure is to serve it through https.
2008/2/1, Dave <ja...@yahoo.com>:
> if a form may contain personal data, it should be summitted using https. Also we need to let user know it is secure by showing a lock and https://.... in browser address bar.
>
> sometimes The IE browser shows a warning: the page contains both secure and nonsecure data. what is the meaning? how to avoid the warning?
>
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to use https together with http
Posted by David Brown <da...@davidwbrown.name>.
Hello Dave, in the future reply with more info and you will get better help. I will put an example at the bottom. I'm an old-school JSP guy and not a JSF guy but I understand that JSF files still end in (dot).jsp? If I'm right then the rules should apply where a security constraint is defined. You will have to use a <realm>. The Tomcat default install comes with an example that does this in server.xml. Use a JAAS realm or a LDAP realm for FORM based security.
<security-constraint></security-constraint>
The path to your confidential pages need to be defined here.
The warning comes (especially I.E.) because you do not have a CA CERT for ssl. You can generate your own CERT with the gentool. Again, the Tomat doco is your starting point:
http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html
and
http://tomcat.apache.org/tomcat-5.5-doc/realm-howto.html#What%20is%20a%20Realm?
Performance: JSF is about 50 to 500 times slower than JSP. See:
http://mindprod.com/jgloss/jsf.html
INFO:
OS: Debian 3.1, Window 2003 server
DB: Oracle 9i
Tomcat: 5.5.x
JDK/JRE: 1.6.x
VM: Xen and VMWARE
Topology: clustered TC with load balancer
Logging: Log4j, commons-logging, system logs (examples etc. for exceptions).
Dave wrote ..
> For jsf page (myfaces), some data need to go through SSL such as bank information.
> For better performance, other pages(or forms) can use http.
>
> <h:form> ... </h:form>
>
> <h:form> ... </h:form>
>
> if a form may contain personal data, it should be summitted using https. Also
> we need to let user know it is secure by showing a lock and https://.... in browser
> address bar.
>
> How can I do this?
>
> sometimes The IE browser shows a warning: the page contains both secure and nonsecure
> data. what is the meaning? how to avoid the warning?
>
> Thanks for ideas.
> Dave
>
>
> ---------------------------------
> Looking for last minute shopping deals? Find them fast with Yahoo! Search.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org