You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@turbine.apache.org by Ilan Azbel <il...@mdio.net> on 2003/06/06 16:15:46 UTC
Mixed SSL and non-SSL site
I want to have ALL my pages on my website using SSL, except for index.jsp
that would redirect to the login page via SSL.
I find that if I allow the http connector on pert 80 then the whole site can
be accessed by http. How can I configure my website in such as way so as to
allow http connection only the index.jsp page and then force https to be
used for the rest of the site.
Ilan
---------------------------------------------------------------------
To unsubscribe, e-mail: turbine-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: turbine-user-help@jakarta.apache.org
RE: Mixed SSL and non-SSL site
Posted by Chris K Chew <ch...@fenetics.com>.
TemplateLink should automatically adjust to SSL (https) requests.
Turbine pretty much requires one to get pretty creative with screen
classes...
Whenever I have a group of screens that require SSL, I create an abstract
XXXSecureScreen that includes something like the code below. Then, any
screen that requires SSL inherits from the abstract XXXSecureScreen.
if( !getData().getServerData().getServerScheme().equals("https") )
{
throw new Exception("Requests must be made over a secure channel.");
}
Chris
> -----Original Message-----
> From: Brent Peckover [mailto:bpeckover@itaes.com]
>
> I've run into a similar problem that would match your symptoms. I
> haven't actually look at the code because it currently doesn't affect
> me, but I believe the Link object that is used to build the links in the
> Velocity templates is created on the first request to the site and then
> cached for all subsequent requests. You can create your own link object
> using the TemplateLink class. I don't know when the link object is
> inserted into the context object, but you could try overwriting it with
> your own link object in your screen classes, that is create a new
> template link object based on each request (that should ensure the right
> port and protocol is used). If you can't over write it in the context,
> because it is added later, add it using a different key and then refer
> to the object in all your templates with the new key.
>
> Ilan Azbel wrote:
>
> >I want to have ALL my pages on my website using SSL, except for index.jsp
> >that would redirect to the login page via SSL.
> >
> >I find that if I allow the http connector on pert 80 then the
> whole site can
> >be accessed by http. How can I configure my website in such as
> way so as to
> >allow http connection only the index.jsp page and then force https to be
> >used for the rest of the site.
---------------------------------------------------------------------
To unsubscribe, e-mail: turbine-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: turbine-user-help@jakarta.apache.org
Re: Mixed SSL and non-SSL site
Posted by Brent Peckover <bp...@itaes.com>.
Ilan,
I've run into a similar problem that would match your symptoms. I
haven't actually look at the code because it currently doesn't affect
me, but I believe the Link object that is used to build the links in the
Velocity templates is created on the first request to the site and then
cached for all subsequent requests. You can create your own link object
using the TemplateLink class. I don't know when the link object is
inserted into the context object, but you could try overwriting it with
your own link object in your screen classes, that is create a new
template link object based on each request (that should ensure the right
port and protocol is used). If you can't over write it in the context,
because it is added later, add it using a different key and then refer
to the object in all your templates with the new key.
Brent.
bpeckover@itaes.com
*********************
ITAES Inc.
(403) 213-5588
http://www.itaes.com
Ilan Azbel wrote:
>I want to have ALL my pages on my website using SSL, except for index.jsp
>that would redirect to the login page via SSL.
>
>I find that if I allow the http connector on pert 80 then the whole site can
>be accessed by http. How can I configure my website in such as way so as to
>allow http connection only the index.jsp page and then force https to be
>used for the rest of the site.
>
>Ilan
>
>
>
>
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: turbine-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: turbine-user-help@jakarta.apache.org
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: turbine-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: turbine-user-help@jakarta.apache.org
RE: Mixed SSL and non-SSL site
Posted by Quinton McCombs <qm...@nequalsone.com>.
My solution to this was to use Apache in front of tomcat. The non-ssl
virtual host in Apache has a single page that simply redirects the user
to the ssl version. It is not possible to access the webapp from the
non-ssl version.
I think that you can configure your web.xml to specify that certain
pages must be over SSL.
--------------------------------------------
Quinton McCombs
NequalsOne - HealthCare marketing tools
mailto:qmccombs@NequalsOne.com
http://www.NequalsOne.com
> -----Original Message-----
> From: Ilan Azbel [mailto:ilan@mdio.net]
> Sent: Friday, June 06, 2003 9:16 AM
> To: Turbine-User
> Subject: Mixed SSL and non-SSL site
>
>
> I want to have ALL my pages on my website using SSL, except
> for index.jsp that would redirect to the login page via SSL.
>
> I find that if I allow the http connector on pert 80 then the
> whole site can be accessed by http. How can I configure my
> website in such as way so as to allow http connection only
> the index.jsp page and then force https to be used for the
> rest of the site.
>
> Ilan
>
>
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: turbine-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: turbine-user-help@jakarta.apache.org
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: turbine-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: turbine-user-help@jakarta.apache.org