URGENT: Secure form submittal

["Bauer, John" <JB...@Juniper.com>]

I have an unsecure web page with a logon form on it.  When the user clicks
"Logon", I want the form submitted to a struts action using HTTPS.  With a
normal form, this is trivial, just provide a full URL (with the scheme and
hostname)for the action and it works just fine.

With a Struts-based form, when I try the same thing, I get the following
error:

Wed Nov 07 16:35:33 EST 2001:<E> <WebAppServletContext-General> Root cause
of ServletException
javax.servlet.jsp.JspException: Cannot retrieve mapping for action
/https://localhost:7001/acti
on/login

It is assuming that the action is the relative mapping instead of the full
URL.  How does one submit a struts form using HTTPS?   Note that I do not
want to redirect to HTTPS, since that would cause the userid and password to
be sent in the clear.

Thanks for any help.

John




_______________________________________________________ 

Juniper Bank 
"Rated #1 in Customer Confidence" 
Gomez Inc., Summer 2001 Internet Credit Card Scorecard 
www.juniper.com 
_______________________________________________________ 

This e-mail and any files transmitted with it may contain confidential
and/or proprietary information. It is intended solely for the use of the
individual or entity who is the intended recipient. Unauthorized use of this
information is prohibited. If you have received this in error, please
contact the sender by replying to this message and delete this material from
any system it may be on.

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

RE: URGENT: Secure form submittal

[David Noll <li...@noll.org>]

The form tag uses the HTTP response of the page displaying the form to
encode the action (cf
http://cvs.apache.org/viewcvs/jakarta-struts/src/share/org/apache/struts/tag
lib/html/FormTag.java).

Your only option, at this time, is to display the data entry form using
HTTPS. Having done that, the response will encode your form's action
properly. FWIW, displaying the form using HTTPS is probably a smart
idea--users will see the "closed lock" icon when entering their data, which
has important non-technical benefits.

Cheers,
David




-----Original Message-----
From: Bauer, John [mailto:JBauer@Juniper.com]
Sent: Wednesday, November 07, 2001 4:51 PM
To: 'struts-user@jakarta.apache.org'
Subject: URGENT: Secure form submittal



I have an unsecure web page with a logon form on it.  When the user clicks
"Logon", I want the form submitted to a struts action using HTTPS.  With a
normal form, this is trivial, just provide a full URL (with the scheme and
hostname)for the action and it works just fine.

With a Struts-based form, when I try the same thing, I get the following
error:

Wed Nov 07 16:35:33 EST 2001:<E> <WebAppServletContext-General> Root cause
of ServletException
javax.servlet.jsp.JspException: Cannot retrieve mapping for action
/https://localhost:7001/acti
on/login

It is assuming that the action is the relative mapping instead of the full
URL.  How does one submit a struts form using HTTPS?   Note that I do not
want to redirect to HTTPS, since that would cause the userid and password to
be sent in the clear.

Thanks for any help.

John




_______________________________________________________

Juniper Bank
"Rated #1 in Customer Confidence"
Gomez Inc., Summer 2001 Internet Credit Card Scorecard
www.juniper.com
_______________________________________________________

This e-mail and any files transmitted with it may contain confidential
and/or proprietary information. It is intended solely for the use of the
individual or entity who is the intended recipient. Unauthorized use of this
information is prohibited. If you have received this in error, please
contact the sender by replying to this message and delete this material from
any system it may be on.

--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>