Question

This is a bit of a noob question but what do I need to get SSL working in my Java web application (standard sort of Java web app using Stripes for its MVC implementation, Spring and Hibernate)?

I’m deploying my war file on Tomcat 5.5. I only want SSL to be used for certain URLS – any that are transferring the user’s password – so account registration, change password, and login.

Do I just need to get an SSL cert and install it in Tomcat? How do I ensure https is used for only some URLs?

Answer 1

Do I just need to get an SSL cert and install it in Tomcat?

That will be required indeed and you’ll need to configure a secured connector.

How do I ensure https is used for only some URLs?

The recommendation is to encrypt form submission (i.e. use absolute https:// urls in the relevant form action) but also form submission pages themselves if you want to prevent man in the middle attacks.

So use “secured” absolute links everywhere you need and enforce SSL for specific content using security constraints in your web.xml:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Secure Area</web-resource-name>
        <url-pattern>/secure/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>