https and cookies

[Pradeep bhatt]

Does https require cookie to be enabled?

[Lasse Koskela]

No, you don't need to have cookies enabled.

[Pankaj Kr]

The way to look at HTTP and HTTPS is that HTTP is usually inplemented on top of TCP/IP whereas HTTPS is over SSL (which itself is a layer over TCP/IP). So, nothing is different in HTTPS data packets than HTTP packets. Also, once the connection is established, the processing of data packets remain the same.
This has many consequences -- (i) HTTP authentication mechanism (Basic and Digest) can be applied over HTTPS as well. In fact, I really like the idea of Basic authentication over HTTPS. (ii) You can continue to have HTTP level compression, chunking etc. of data. (iii) Things like cookies continue to work. Besides these, many more properties of HTTP continue to be valid for HTTPS.

[Peter den Haan]

One crucial difference is that with HTTPS, the server can use the SSL session for session tracking (i.e., keeping track of your HttpSession). With plain old HTTP, the server needs to use a temporary cookie or URL rewriting.
- Peter

[Pankaj Kr]

Originally posted by Peter den Haan:
One crucial difference is that with HTTPS, the server can use the SSL session for session tracking (i.e., keeping track of your HttpSession). With plain old HTTP, the server needs to use a temporary cookie or URL rewriting.
- Peter

This is certainly a possibility. However, most of the Java Web Container applications do not make use of HTTPS Session information for user level session tracking. One reason is that the code doing the session tracking is usually at a higher layer and same for both HTTP and HTTPS. Also, persistent cookie based session can survive a browser close whereas HTTPS based sessions cannot. There are also some interesting corner cases when a user creates a new Browser (by clicking Ctrl-N in IE) in the middle of a session.

[Pradeep bhatt]

I have a requirement where I need to switch from secure to non secure to secure and so on. Which session handling method is appropriate ?

[Juanjo Bazan]

Originally posted by Pradeep Bhat:
I have a requirement where I need to switch from secure to non secure to secure and so on. Which session handling method is appropriate ?

Probably, using persistent cookie based sessions will be the best solution for that case.
Anyway, switching from secure to non secure pages many times could result a bit uncomfortable for users as they receive too many warning messages from the browser.