: DNS name/host-header specific url-pattern/security-constraint, to not require SSL with Tomcat6 I am needing to enable SSL on an application hosted through Tomcat6 and I have added the following

@Michele947

Posted in: #Dns #Https #Security #UrlRewriting

I am needing to enable SSL on an application hosted through Tomcat6 and I have added the following to the tomcat web.xml:

<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>


and setup the redirectPort as 443, in server.xml - this setup works fine.

I am needing to allow access to the application, without requiring SSL, when the app is accessed using a specific dns name.

For example:

the SSL certificate for the application is associated with the DNS name

xyz.applicationdomain.com

when the application is accessed with this name, a redirect occurs, and the URL changes to
xyz.applicationdomain.com
but when the application is accessed with

abc.applicationdomain.com, the application needs to be accessible without requiring SSL.

is it possible to implement this using another security-constraint definition?

Vote Up Vote Down

Login to post a comment!