[jira] [Closed] (TAP5-167) Applications should support both secured or unsecured access based on initial access method

["Massimo Lusetti (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TAP5-167?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Massimo Lusetti closed TAP5-167.
--------------------------------

       Resolution: Won't Fix
    Fix Version/s: 5.3

Even if I find this as something that could be improved I'll close it

Please open a new one for 5.3 if this still applicable

> Applications should support both secured or unsecured access based on initial access method
> -------------------------------------------------------------------------------------------
>
>                 Key: TAP5-167
>                 URL: https://issues.apache.org/jira/browse/TAP5-167
>             Project: Tapestry 5
>          Issue Type: Improvement
>    Affects Versions: 5.0.15
>            Reporter: Jonathan Barker
>            Priority: Minor
>             Fix For: 5.3
>
>
> The ability to mix secured and unsecured pages with the @Secured annotation means that anything not marked as @Secured will have unsecured URLs' generated.  As a result, it is not possible to make an application all secured using firewall rules for external access, but unsecured for internal access.
> It would be useful to support, at least for applications using the session, the ability to have the default protocol remembered based on the method of first access.  This would support multiple security modes.
> A possible configuration flag would be MetaDataContants.SECURE_PAGE_DEFAULT where the available values are "true", "false", "any"
> This also helps troubleshoot when you have Apache HTTP -> mod_jk -> Tomcat, where only internal systems can directly hit Tomcat.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira