Using SSL and Non-SSL in Tomcat 6

Question

I have a Tomcat 6 server, and I want everything to be SSL, but I want one servlet to be accessible via non-ssl. Can Tomcat be configured this way? It is currently configured to forward all requests to the secure port.

Answer 1

One way to achieve this is to edit web.xml for your web application.

I assume that you already have a web application configured to force all requests to https using <transport-guarantee> CONFIDENTIALas shown below

<security-constraint>
      <display-name>Example Security Constraint</display-name>
      <web-resource-collection>
         <web-resource-name>Protected Area</web-resource-name>
     <!-- Define the context-relative URL(s) to be protected -->
         <url-pattern>/*</url-pattern>
     <!-- If you list http methods, only those methods are protected -->
     <http-method>DELETE</http-method>
         <http-method>GET</http-method>
         <http-method>POST</http-method>
     <http-method>PUT</http-method>
      </web-resource-collection>
      <auth-constraint>
         <!-- Anyone with one of the listed roles may access this area -->
         <role-name>tomcat</role-name>
     <role-name>role1</role-name>
      </auth-constraint>
      <user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
    </security-constraint>

Now add one more block below this for the servlet that you want to bypass https for.

    <security-constraint>
<web-resource-collection>
<web-resource-name>Unsecured resources</web-resource-name>
<url-pattern>/jsp/openforall.jsp</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint> 

This openforall.jsp URL will now be accessible via http.

Note. This URL will also be available on https if someone accesses it this way.