Return to HTTP from HTTPS

[Salvo Montalbano]

Hi all,

in my web.xml I declared a resource under the block
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
This resource is about a login page.
But when I logout or when I visit some pages like Contacts or Home Page, I wouldn't use HTTPS protocol
At the moment, HTTPS remain in the url even if I declared this protocol only for that resource
This is my (little) web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  
  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
  </welcome-file-list>
  
  <login-config>
    <auth-method>FORM</auth-method>    
    <form-login-config>
      <form-login-page>/login.jsp</form-login-page>
      <form-error-page>/loginError.jsp</form-error-page>
    </form-login-config>
  </login-config>
  
  <security-role>
    <role-name>admin</role-name>
  </security-role>
  <security-role>
    <role-name>user</role-name>
  </security-role>
  
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Area1</web-resource-name>
      <url-pattern>/login_resource/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>*</role-name>      
    </auth-constraint>
   <user-data-constraint>
    	<transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint> 
  </security-constraint> 
  </web-app>

Does anybody can help me to solve this problem?
Hoping my explanation is clear, thank you in advance for you replies.

SM

[Salvo Montalbano]

I think I solved my problem and I post my solution might be useful in future to another newbie (like me )
I'm also interested to learn other ways to reach my scope.
I put this filter declaration in web.xml
<filter> <filter-name>redirectFilter</filter-name> <filter-class>it.myprojects.HttpsRedirectFilter</filter-class> </filter> <filter-mapping> <filter-name>redirectFilter</filter-name> <url-pattern>/logout</url-pattern> </filter-mapping>

I also write this class:

package it.myprojects;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class HttpsRedirectFilter implements Filter{
 
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
         if((request instanceof HttpServletRequest) && (response instanceof HttpServletResponse)){
             String redirectTarget =  ((HttpServletRequest)request).getRequestURL().toString().replaceFirst("https", "http");
             redirectTarget =  redirectTarget.replaceFirst(":8443", ":8080");
             redirectTarget =  redirectTarget.replaceFirst("logout", "index.jsp");
             if(request.isSecure()){            	 
            	 ((HttpServletResponse)response).sendRedirect(redirectTarget);
             }
             else{
                 chain.doFilter(request, response);
             }
         }
     }

	@Override
	public void destroy() {		
	}

	@Override
	public void init(FilterConfig arg0) throws ServletException {	
	}
}

In this way when i go to logout I make some string operations (that edit protocol and port) and perform a redirect to the home page.
Regards

SM

[Dave Alexander]

This is so amazing!!!
Finally I found it!!!
Thanks!!! ;)