Johnny Kewl wrote:
If the pages are password protected you can use
<security-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
This is not correct. You need:
<security-constraint>
<web-resource-collection>
<web-resource-name>Everything</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
And it becomes fun if you using SSL on non protected pages.
Then (I think) you have to drop the above techniques in favor of
checking for SSL with
request.isSecure()
and redirecting to the HTTPs link yourself..
and not doing that if you dont want that.
Again, not correct. Just use web.xml
Probably the easiest is to protect the pages that need SSL and use
security-constraint
Using the security constraint is certainly the easiest way to do this.
Mark
---------------------------------------------------------------------
To start a new topic, e-mail: [email protected]
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
