Enabling HTTPS in J2EE Web components

Enabling HTTPS in J2EE Web components

How do I implement HTTPS protocol for JSP? Or, how do configure SSL in a Web application? My platform is WebLogic 8.1, Windows.

    Requires Free Membership to View

    Login

    When you register, you'll receive targeted emails designed to keep you informed of the most relevant information on Agile development, application security, testing & QA, software requirements, and more.

    Hannah Smalltree, Editorial Director

    By submitting your registration information to SearchSoftwareQuality.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSoftwareQuality.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

The Java EE (J2EE) platform defines an XML-based "Web Deployment Descriptor (web.xml)" for specifying configuration features that allows the enforcement of secure communication using HTTP with SSL/TLS protocols for Web components such as Java Server Pages (JSPs) and servlets.

To enable HTTPS communication support in Web components, the "<transport-guarantee>" sub-element of the "<user-data-constraint>" sub-element of a "<security-constraint>" element must be specified as "CONFIDENTIAL" in the Web deployment descriptor. The following XML snippet illustrates the Web deployment descriptor (web.xml) showing the "<transport-guarantee>" sub-element:

<web-app>
   . . .
  <security-constraint>
    . . .
       <user-data-constraint>
         <transport-guarantee>
              CONFIDENTIAL
            </transport-guarantee>
       </user-data-constraint>
     . . .
   </security-constraint>
  . . .
</web-app>

In general, it is the responsibility of the Web application developer/assembler to define the required attributes for a Web application before its deployment to the Java EE application server.

As it is a standard practice, the Web deployment descriptor specified information applies to all Java EE providers such as BEA Systems' WebLogic, IBM's WebSphere, Sun Java System Application Server, JBoss and also its underlying operating systems.

More information:

This was first published in January 2007