Hi, 2013/9/30 André Warnier <[email protected]>: > Hi. > [...] > The question is now : why does that application require HTTPS ? > An application usually doesn't care how it is accessed, except if some > configuration of the application requires it to get some information from > the SSL protocol (like a user certificate or so). What does this > application need ? > >
I don't agree, the application should know how it is accessed, if only because some pages may require SSL (all page under an auth-constraint) and others not, and it should not be delegated to apache but required at the tomcat level. I really think that saying to an application "do not care about SSL it is our problem" will lead to all sort of security incomprehension in the future. Espcially when it is as easy as adding a valve in server.xml to do so (as said by Daniel Mikusa), or if it is an option, configuring AJP between tomcat and httpd, which then requires nothing on the tomcat side. Cédric --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
