设置SSL以仅在Tomcat Web应用程序上进行表单登录 [英] Setup SSL for form login only on Tomcat webapp

问题描述

我是否可以将Tomcat(或Web应用程序，如果这样做的话)设置为要求SSL，以确保内置的基于表单的登录机制的机密性?

Can I set Tomcat (or my webapp if it's done that way) to require SSL for confidentiality of the built-in Form-Based Login mechanism?

即保护用户凭据，并使用标准的http进行其他任何交易?

i.e. to protect the users credentials, and use standard http for any other transactions?

推荐答案

您可以将登录表单放在其自己的目录中，只需要SSL即可访问该目录，

You can put your login forms in its own directory and just require SSL for the directory,

<security-constraint>
  <display-name>Login Pages</display-name>
  <web-resource-collection>
     <web-resource-name>Login</web-resource-name>
     <url-pattern>/login/*</url-pattern>
     <http-method>POST</http-method>
  </web-resource-collection>
  <user-data-constraint>
     <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

确保您的登录表单位于此路径中，

Make sure your login form is in this path,

<login-config>
  <auth-method>FORM</auth-method>
  <form-login-config>
    <form-login-page>/login/form_login.jsp</form-login-page>
    <form-error-page>/login/error.jsp</form-error-page>
  </form-login-config>
</login-config>

当然，您需要在Tomcat上设置SSL连接器.

Of course, you need to have a SSL connector setup on your Tomcat.

这篇关于设置SSL以仅在Tomcat Web应用程序上进行表单登录的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！