Redirecting to secure server (ie from http:// to https://)

[Michael Mok <mi...@consultech.net.au>]

To those who have done it

Can you advice on how you manage to redirect the http request from http to
https?

I have following scenario (typical of a shopping site).

1) User search and place item into shopping cart (eg calls
http://www.acmeshop.com/addtoshoppingcart.do)
2) addtoshoppingcart.do do some processing and redirects user back to
shopping search page (eg http://www.acmeshop.com/shoppingsearch.jsp )
3) User clicks on the check out page URL. (eg calls
http://www.acmeshop.com/showshoppingcart.do and return the results to
http://www.acmeshop.com/showcartcheckout.jsp).
4) User clicks on make payment. On the shwowcartcheckout.jsp, I need to be
able to set the form action attribute to call
https://www.acmeshop.com/makepayment.do (where makepayment.do will redirect
to the https://www.acmeshop.com/enterpaymentdetail.jsp). The form action
attribute on the enterpaymentdetail.jsp will call
https://www.acmeshop.com/processpayment.do )

What I am trying to find out is how do I set the https:// in the form action
attribute of showcartcheckout.jsp. The form tag does not have any attribute
will will create the https://...  string. Do I have to hard code the form
action in this page? Or am I total off the track?

Thanks in advance

Michael Mok

Re: Redirecting to secure server (ie from http:// to https://)

[Ted Husted <hu...@apache.org>]

This is still a very messy area. I ended hardcoding some strings in a
production application, but there solutions that would mitigate this, so
you only have to hardcode the scheme in your struts-config file. See 

To SSL and Back Again

<
http://www.mail-archive.com/struts-dev@jakarta.apache.org/msg01357.html
>
<
http://www.mail-archive.com/struts-dev@jakarta.apache.org/msg01361.html
>
<
http://www.mail-archive.com/struts-user@jakarta.apache.org/msg08028.html
>
<
http://www.mail-archive.com/struts-user@jakarta.apache.org/msg07850.html
>
<
http://www.mail-archive.com/struts-user@jakarta.apache.org/msg07796.html
>
<
http://www.mail-archive.com/struts-user@jakarta.apache.org/msg06454.html
>

We definatley need to document the best-practice for doing this, as soon
as we figure out what that is ;-)


Michael Mok wrote:
> 
> To those who have done it
> 
> Can you advice on how you manage to redirect the http request from http to
> https?
> 
> I have following scenario (typical of a shopping site).
> 
> 1) User search and place item into shopping cart (eg calls
> http://www.acmeshop.com/addtoshoppingcart.do)
> 2) addtoshoppingcart.do do some processing and redirects user back to
> shopping search page (eg http://www.acmeshop.com/shoppingsearch.jsp )
> 3) User clicks on the check out page URL. (eg calls
> http://www.acmeshop.com/showshoppingcart.do and return the results to
> http://www.acmeshop.com/showcartcheckout.jsp).
> 4) User clicks on make payment. On the shwowcartcheckout.jsp, I need to be
> able to set the form action attribute to call
> https://www.acmeshop.com/makepayment.do (where makepayment.do will redirect
> to the https://www.acmeshop.com/enterpaymentdetail.jsp). The form action
> attribute on the enterpaymentdetail.jsp will call
> https://www.acmeshop.com/processpayment.do )
> 
> What I am trying to find out is how do I set the https:// in the form action
> attribute of showcartcheckout.jsp. The form tag does not have any attribute
> will will create the https://...  string. Do I have to hard code the form
> action in this page? Or am I total off the track?
> 
> Thanks in advance
> 
> Michael Mok

-- Ted Husted, Husted dot Com, Fairport NY USA.
-- Custom Software ~ Technical Services.
-- Tel 716 737-3463.
-- http://www.husted.com/about/struts/