Configure SSL to work with Java web app on Tomcat 5.5 server

Question

This is a bit of a noob question but what do I need to get SSL working in my Java web application (standard sort of Java web app using Stripes for its MVC implementation, Spring and Hibernate)?

I'm deploying my war file on Tomcat 5.5. I only want SSL to be used for certain URLS - any that are transferring the user's password - so account registration, change password, and login.

Do I just need to get an SSL cert and install it in Tomcat? How do I ensure https is used for only some URLs?

Answer 1

You can make a Filter that redirects to https:// for the URLs you want.

Answer 2

Do I just need to get an SSL cert and install it in Tomcat?

The Tomcat manual has a pretty easy-to-follow guide on how to set ts up.

How do I ensure https is used for only some URLs?

This piece of logic needs to be in your application. Bozho's solution would certainly work, there may be other solutions if you are using particular web frameworks or not.

Answer 3

Yes, you need a SSL cert. It can either be self signed or issued by an officially recognized certification authority.

Here's a good tutorial about the general setup of SSL in Tomcat and how to modify the deployment descriptor to enable SSL : http://www.jroller.com/gmazza/entry/setting_up_ssl_and_basic

Answer 4

Do I just need to get an SSL cert and install it in Tomcat?

That will be required indeed and you'll need to configure a secured connector.

How do I ensure https is used for only some URLs?

The recommendation is to encrypt form submission (i.e. use absolute https:// urls in the relevant form action) but also form submission pages themselves if you want to prevent man in the middle attacks.

So use "secured" absolute links everywhere you need and enforce SSL for specific content using security constraints in your web.xml:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Secure Area</web-resource-name>
        <url-pattern>/secure/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>