Avoiding the Got a insecure (non-https) form POST warning when running non-secure between Apache and Tomcat

2010-03-04 Thread Brett Palmer
We use Apache web servers to communicate with our OFBiz servers using a combination of mod_jk and mod_proxy. For our mod_proxy configuration, we forward secure requests (https) from Apache to a non-secure port (8080) on Tomcat/OFBiz. Our application is an AJAX/Dojo application that posts normal

Re: Avoiding the Got a insecure (non-https) form POST warning when running non-secure between Apache and Tomcat

2010-03-04 Thread Scott Gray
On 4/03/2010, at 10:50 AM, Brett Palmer wrote: We use Apache web servers to communicate with our OFBiz servers using a combination of mod_jk and mod_proxy. For our mod_proxy configuration, we forward secure requests (https) from Apache to a non-secure port (8080) on Tomcat/OFBiz. Hi

Re: Avoiding the Got a insecure (non-https) form POST warning when running non-secure between Apache and Tomcat

2010-03-04 Thread Brett Palmer
Scott, We don't really have a good reason for turning it off. Here were some of the reasons: - The initial thought was secure connections between web and application servers was not necessary as these are behind the firewall. - We also thought we might be improving performance by not encrypting

Re: Avoiding the Got a insecure (non-https) form POST warning when running non-secure between Apache and Tomcat

2010-03-04 Thread Scott Gray
I don't have a recommendation as such, it was just a thought to get you to the quickest possible solution. The options as I see it are: 1. Switch back to using https 2. Submit patches so that these warnings/error aren't logged for every request, perhaps just at startup or perhaps have another

Re: Avoiding the Got a insecure (non-https) form POST warning when running non-secure between Apache and Tomcat

2010-03-04 Thread Adrian Crum
Scott Gray wrote: I don't have a recommendation as such, it was just a thought to get you to the quickest possible solution. The options as I see it are: 1. Switch back to using https 2. Submit patches so that these warnings/error aren't logged for every request, perhaps just at startup or

Re: Avoiding the Got a insecure (non-https) form POST warning when running non-secure between Apache and Tomcat

2010-03-04 Thread Jacques Le Roux
Also you might be interested by mod_proxy_ajp, a simple setting here http://cwiki.apache.org/confluence/display/OFBIZ/FAQ+-+Tips+-+Tricks+-+Cookbook+-+HowTo#FAQ-Tips-Tricks-Cookbook-HowTo-HTTPD Jacques From: Adrian Crum adri...@hlmksw.com Scott Gray wrote: I don't have a recommendation as

Re: Avoiding the Got a insecure (non-https) form POST warning when running non-secure between Apache and Tomcat

2010-03-04 Thread Brett Palmer
Thanks that was a helpful link. We are still trying to determine what performs better, mod_jk or mod_proxy. We thought we found some bottlenecks under heavy loads with mod_Jk but we never confirmed that. I'll update the group on our findings as we discover them. Brett On Thu, Mar 4, 2010 at