Home/ Questions/Q 9019503
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T04:47:36+00:00

For Servlet security, I read that in web.xml we can declare <auth-constraints> and <user-data-constraint>

  • 0

For Servlet security, I read that in web.xml we can declare

<auth-constraints> and <user-data-constraint>

for turning on the SSL and for authentication purposes. But so far I personally haven’t seen any of these declarations in real life web.xml’s (apps running on Tomcat, Glassfish)

So I wonder what are the substitute ways of achieving these goals? and which way is preferred?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Depends strongly on the used application server, but in general there is no way to make application server to expose the application using SSL without enabling it on the level of the AS (not the deployment descriptor).

    For instance for Tomcat, the SSL connector (default port 8443) has to be enabled in server.xml. You may then use Apache (httpd) as a reverse proxy using mod_proxy or mod_jk.

    In the code you may use ServletFilter to intercept all the requests and if the communication is not on top of SSL, you may redirect the user to some login page.

    • 0