You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Roger David Powers <pr...@yahoo.com> on 2009/09/03 21:18:40 UTC
Change redirect to SSL behavior?
The description of redirectPort for HTTP connector says:
If this Connector is supporting non-SSL requests, and a request is received for which a matching <security-constraint> requires SSL transport, Catalina will automatically redirect the request to the port number specified here.
The default is specified as port 443 which is of course the default SSL
port.
In Tomcat 3, there was a way to disable this behavior, i.e. if the end user
connects to http://webapps and not use https for the given webapp, that was
supported. If the user explicitly went to https://webapp they'd still get
TlS/SSL as desired.
I'm not seeing how to do this with Tomcat 6. If I take redirectPort out of the http connector, I still get the redirect, to the default 443 port.
Having the ability to not get redirected to SSL/TLS avoids the users see
issues with incorrect certificates, which unfortunately happens more
often than I'd like.
Is there a config or a workaround for this?
Thanks,
RP
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Change redirect to SSL behavior?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Caldarale, Charles R [mailto:Chuck.Caldarale@unisys.com]
> Subject: RE: Change redirect to SSL behavior?
>
> > From: Roger David Powers [mailto:progpwr@yahoo.com]
> > Subject: RE: Change redirect to SSL behavior?
> >
> > Thanks, but what I want is for the user to get https when they
> > type https://webapp and get http when they type http://webapp.
>
> What I suggested should do exactly that.
Assuming you configured an HTTPS <Connector> on port 443, of course.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Change redirect to SSL behavior?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Roger David Powers [mailto:progpwr@yahoo.com]
> Subject: RE: Change redirect to SSL behavior?
>
> Thanks, but what I want is for the user to get https when they
> type https://webapp and get http when they type http://webapp.
What I suggested should do exactly that.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Change redirect to SSL behavior?
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Roger (danger is /not/ my middle name ha ha),
On 9/3/2009 5:04 PM, Roger David Powers wrote:
> Thanks, but what I want is for the user to get https when they
> type https://webapp and get http when they type http://webapp.
> Is there a different transport-guarantee classification to get
> that behavior?
That's what you'll get if you have no <transport-guarantee> statement at
all. If you do
<transport-guarantee>CONFIDENTIAL|INTEGRAL</transport-guarantee>, then
any HTTP connections (that is, non-secure ones) will be redirected to
HTTPS. In the absence of such configuration, no redirect will ever take
place.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkqgNB4ACgkQ9CaO5/Lv0PAYugCghxRyfgKg5x/9156WDNpL5geM
POcAnRPKob0nnuIP4OMCz780bkRJ3O7I
=ac5j
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Change redirect to SSL behavior?
Posted by Roger David Powers <pr...@yahoo.com>.
Thanks, but what I want is for the user to get https when they
type https://webapp and get http when they type http://webapp.
Is there a different transport-guarantee classification to get
that behavior?
--- On Thu, 9/3/09, Caldarale, Charles R <Ch...@unisys.com> wrote:
> From: Caldarale, Charles R <Ch...@unisys.com>
> Subject: RE: Change redirect to SSL behavior?
> To: "Tomcat Users List" <us...@tomcat.apache.org>
> Date: Thursday, September 3, 2009, 3:24 PM
> > From: Roger David Powers
> [mailto:progpwr@yahoo.com]
> > Subject: Change redirect to SSL behavior?
> >
> > Having the ability to not get redirected to SSL/TLS
> avoids the users
> > see issues with incorrect certificates, which
> unfortunately happens
> > more often than I'd like.
> >
> > Is there a config or a workaround for this?
>
> If you don't actually care about confidentiality, just
> remove the <transport-guarantee> element from the
> webapp's WEB-INF/web.xml file.
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR
> OTHERWISE PROPRIETARY MATERIAL and is thus for use only by
> the intended recipient. If you received this in error,
> please contact the sender and delete the e-mail and its
> attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Change redirect to SSL behavior?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Roger David Powers [mailto:progpwr@yahoo.com]
> Subject: Change redirect to SSL behavior?
>
> Having the ability to not get redirected to SSL/TLS avoids the users
> see issues with incorrect certificates, which unfortunately happens
> more often than I'd like.
>
> Is there a config or a workaround for this?
If you don't actually care about confidentiality, just remove the <transport-guarantee> element from the webapp's WEB-INF/web.xml file.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Change redirect to SSL behavior?
Posted by Roger David Powers <pr...@yahoo.com>.
Sorry about that, I didn't catch that last e-mail.
I will do some testing to see if my observations agree with yours.
Thanks!
RDP
--- On Wed, 9/16/09, Caldarale, Charles R <Ch...@unisys.com> wrote:
> From: Caldarale, Charles R <Ch...@unisys.com>
> Subject: RE: Change redirect to SSL behavior?
> To: "Tomcat Users List" <us...@tomcat.apache.org>
> Date: Wednesday, September 16, 2009, 3:20 PM
> > From: Roger David Powers
> [mailto:progpwr@yahoo.com]
> > Subject: Re: Change redirect to SSL behavior?
> >
> > Second try: any input?
>
> You already got the answer, which you appear to be
> ignoring.
> http://marc.info/?t=125200558500003&r=1&w=2
>
> - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR
> OTHERWISE PROPRIETARY MATERIAL and is thus for use only by
> the intended recipient. If you received this in error,
> please contact the sender and delete the e-mail and its
> attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Change redirect to SSL behavior?
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Roger David Powers [mailto:progpwr@yahoo.com]
> Subject: Re: Change redirect to SSL behavior?
>
> Second try: any input?
You already got the answer, which you appear to be ignoring.
http://marc.info/?t=125200558500003&r=1&w=2
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Change redirect to SSL behavior?
Posted by Roger David Powers <pr...@yahoo.com>.
Second try: any input?
A workaround would seem to be to not configure the ssl
connector till it is needed, but doing that requires
a restart of tomcat (right?) which is too disruptive
in my environment.
--- On Thu, 9/3/09, Roger David Powers <pr...@yahoo.com> wrote:
> From: Roger David Powers <pr...@yahoo.com>
> Subject: Change redirect to SSL behavior?
> To: "Tomcat Users List" <us...@tomcat.apache.org>
> Date: Thursday, September 3, 2009, 3:18 PM
> The description of redirectPort for
> HTTP connector says:
>
> If this Connector is supporting non-SSL requests, and a
> request is received for which a matching
> <security-constraint> requires SSL transport, Catalina
> will automatically redirect the request to the port number
> specified here.
>
> The default is specified as port 443 which is of course the
> default SSL
> port.
>
> In Tomcat 3, there was a way to disable this behavior, i.e.
> if the end user
> connects to http://webapps and not use https for the given webapp,
> that was
> supported. If the user explicitly went to https://webapp
> they'd still get
> TlS/SSL as desired.
>
> I'm not seeing how to do this with Tomcat 6. If I
> take redirectPort out of the http connector, I still get the
> redirect, to the default 443 port.
>
> Having the ability to not get redirected to SSL/TLS avoids
> the users see
> issues with incorrect certificates, which unfortunately
> happens more
> often than I'd like.
>
> Is there a config or a workaround for this?
>
> Thanks,
> RP
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org