This is strange, why are you sending requests with my name (in the from address of this email)?
[EMAIL PROTECTED] > -----Original Message----- > From: Reynir Hübner [mailto:[EMAIL PROTECTED]] > Sent: 17. júlí 2002 11:27 > To: [EMAIL PROTECTED] > Subject: Redireceting HTTP -> HTTPS > > > > Hello all, > > Have any of you experienced Tomcat changing the *domain name* > of the request to "localhost" when you're trying to > automatically redirect from HTTP to HTTPS? We know that it's > supposed to change the protocol and the port, but the domain as well? > > Here's the situation: > I have a directory ("db") on my site (for the sake of this > email, "www.mysite.com") that I want to protect using SSL. > Additionally, I need any wayward HTTP requests to this > directory to be automatically redirected to HTTPS to ensure > that they are SSL-encrypted. > > To set this up, I followed the SSL Configuration How-To, > created the keystore, and generated a private key. I then > edited /conf/server.xml and /WEB-INF/web.xml (details below) > to automatically redirect those certain HTTP requests over to > HTTPS. Finally, I restarted Tomcat. > > Now when I reference my HTTPS URL *directly*, SSL kicks in, > the browser padlock is locked, and everything works great: > https://www.mysite.com:8443/db/index.jsp > > As I stated, however, I've configured the HTTP request: > http://www.mysite.com:8080/db/index.jsp > > To automatically redirect to that HTTPS URL from above: > https://www.mysite.com:8443/db/index.jsp > > BUT, for some reason, Tomcat is changing the domain to LOCALHOST: > https://localhost:8443/db/index.jsp > > So... basically, Tomcat's got it about 80% right. The > protocol and port were succesfully redirected (http 8080 -> > https 8443), but the domain was changed. This instance of > Tomcat is on a remote machine, *NOT* my local machine, so > localhost fails. My question -- why would Tomcat be changing > the server name in such a way? > > > FYI, here is the relevant code from conf/server.xml: > --------------------------------- > > > > > > > > > > > > > > > --------------------------------- > > > Here is the relevant code from web.xml: > --------------------------------- > > > Secure SSL Access > /db/* > > > CONFIDENTIAL > > > --------------------------------- > > Note that I have: > * uncommented the SSL connector > * properly set the HTTP connector's redirectPort to SSL's 8443 > * changed the Engine's defaulthost to www.mysite.com > * changed the Host's name to www.mysite.com > * set the url-pattern match to /db/* in web.xml > * added the CONFIDENTIAL transport-guarantee > > Nothing really extraordinary here. Moreover, a grep for > "localhost" in both of these files returns zero results. I'm > just not sure where it's coming from ... especially when > Tomcat seems to be doing everything *else* correctly here. > > Any ideas? Thanks in advance!! > > -Steve Baker > > > p.s. Performing a brute force solution such as: > -------------------- > if (request.getScheme().equals("http")) { > // oops! response.Redirect() to the https URL instead. > } > -------------------- > ... at the top of every .jsp in my HTTPS-only directory isn't > going to be the right choice for this particular project. I > will eventually employ that as a backup to ensure security, > but I don't wish to go with that as my first line of defense... > > > > > > > ------------------------------------------------ > Join Excite! - http://www.excite.com > The most personalized portal on the Web! > > -- > To unsubscribe, e-mail: > <mailto:[EMAIL PROTECTED]> > For additional commands, e-mail: > <mailto:[EMAIL PROTECTED]> > > -- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>