-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cédric,
On 9/30/13 10:06 AM, Cédric Couralet wrote: > Hi, > > 2013/9/30 André Warnier <[email protected]>: >> Hi. >> > [...] >> The question is now : why does that application require HTTPS ? >> An application usually doesn't care how it is accessed, except if >> some configuration of the application requires it to get some >> information from the SSL protocol (like a user certificate or >> so). What does this application need ? >> >> > > I don't agree, the application should know how it is accessed, if > only because some pages may require SSL (all page under an > auth-constraint) and others not, and it should not be delegated to > apache but required at the tomcat level. I really think that saying > to an application "do not care about SSL it is our problem" will > lead to all sort of security incomprehension in the future. > Espcially when it is as easy as adding a valve in server.xml to do > so (as said by Daniel Mikusa), or if it is an option, configuring > AJP between tomcat and httpd, which then requires nothing on the > tomcat side. Some solutions require nothing on the Tomcat site (hint: mod_jk does all this auto-magically). - -chris -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJSSYXlAAoJEBzwKT+lPKRYowMP/i17wXjo0sw6NGF3amrDlo5n StIXf6CvdyICDQoagiG6QMfb/LcTCbOLEowR+xrtWHWHO2Zr5QkKMjDIRcWrfyNR FgFfgsfAlxyGN45vfKYfWWad2hoUcwevfwMHObJ3/pLDZUNlPsh2Y7cJUEsr8f2N BI9KhyU5WjbZtHL0rIAHgeD/qpMcGlS31tZTG3JsclbqmTqIRmo+aEfZ6WWmVNxG nKheN9hEB5uz7dnxuK4LwTXbBWN22sNJwPuf6JkeLdmFwSv2WF7UAUhfIkoisgL7 Sz3oFAe6bY81UscJ1fZoFOh9ubZPyw0tefl3/ACeZLw7WAZ3yavPCRxJ67ezAFkv 6KverpPGzUHmQzdgLaJjTL+xYVcQKSTOxbY/IrxsO8XoEIG3h6NFudx6WqAqIMsm wGl/KxLcInJEHjVLErDou0zrtApSpZPHQhAv7/KqgJ3D1Swzs+X8FIrxr3dzhi3J bp9mNMpXZZw56U7bn+Fxy70C5QIjAPtaanqFDN42ZcBVhzDsSt8NGT4I0BUWytk7 +fjLQiqcqBYWMeVi1odWmS4F+OmUnjNN5hMmSJC0CYvOMeTql5r395WSDnklGtKW JKc074hYBBqjGHdPwW4s9Ejvq5f7SgGK2rJ+uO9iCMkGy1nC9Mij2FpAsnaLkClC wBFMAMm1BcLHM7WdxvoO =NJeo -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
