On 24 June 2016 at 15:37, Mark Thomas <[email protected]> wrote: > On 24 June 2016 11:51:25 BST, Lyallex <[email protected]> wrote: > > <snip/> > >>However I can't get my head around your assertion that forcing the use >>of TLS is a 'user data constraint' > > Have a look in the Servlet specification for that phrase. I don't have a copy > to hand right now but it will be in the security section.
OK. I'll concede that point, thank you for making that clear In web.xml a security-constraint can contain an <auth-constraint> and or a <user-data-constraint> It makes sense to me that auth-constraint is associated with a Realm given that a Realm is a database of users It still doesn't make sense to me that a user-data-constraint, which is 'all about the scheme' should be managed/configured/maintained (use whatever word feels right) in a component that is 'all about a database'. That's all I'm saying, it just doesn't 'feel right' that's all. As for an alternative solution, well until I can get enough time together to get a build system together I haven't got one, that doesn't mean that there isn't one. Building Tomcat is now working it's way up my todo list. I'll get back to you. Lyallex --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
