Hi,

2013/9/30 André Warnier <[email protected]>:
> Hi.
>
[...]
> The question is now : why does that application require HTTPS ?
> An application usually doesn't care how it is accessed, except if some
> configuration of the application requires it to get some information from
> the SSL protocol (like a user certificate or so).  What does this
> application need ?
>
>

I don't agree, the application should know how it is accessed, if only
because some pages may require SSL (all page under an auth-constraint)
and others not, and it should not be delegated to apache but required
at the tomcat level. I really think that saying to an application  "do
not care about SSL it is our problem"  will lead to all sort of
security incomprehension in the future.
Espcially when it is as easy as adding a valve in server.xml to do so
(as said by Daniel Mikusa), or if it is an option, configuring AJP
between tomcat and httpd, which then requires nothing on the tomcat
side.

Cédric

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to