Not dreaming for a second of contradicting Tim ;) but wouldn't this work?
Switch on SingleSignOn. Install two hosts on the same engine. First host has non-ssl connector only, second has ssl only. Install main webapp on non-ssl host, without the login code. Install just the login code on a simplified webapp on the other host, and add a simple invoker servlet (or similar) to redirect all other requests to urls on the main host. It's not exactly trivial or elegant, and having to switch on SingleSignOn might be a problem in some apps, but could it work? I have been advised by a trusted friend experienced in these matters that these sorts of config are better tackled by fronting your site with apache, and using mod_rewrite to enforce the ssl vs no-ssl requirements. > -----Original Message----- > From: August Detlefsen [mailto:[EMAIL PROTECTED] > Sent: Thursday 26 May 2005 01:43 > To: Tomcat Users List > Subject: Re: Force Non-SSL > > > Is there no way to do it? SSL creates a lot of overhead for a > site that > is serving up 100MB image files. > > > > > --- Tim Funk <[EMAIL PROTECTED]> wrote: > > no > > > > -Tim > > > > August Detlefsen wrote: > > > In my webapp I force clients to use SSL encryption for logins with > > a > > > security constraint and transport-guarantee elements like this: > > > > > > <security-constraint> > > > <web-resource-collection> > > > <web-resource-name>Login</web-resource-name> > > > <url-pattern>/login/*</url-pattern> > > > </web-resource-collection> > > > > > > <user-data-constraint> > > > <transport-guarantee>CONFIDENTIAL</transport-guarantee> > > > </user-data-constraint> > > > </security-constraint> > > > > > > However, once a user hits the login page, every subsequent page > > also > > > uses https. Is there a way to force them back to regular http once > > they > > > leave the login section? > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [EMAIL PROTECTED] > > For additional commands, e-mail: [EMAIL PROTECTED] > > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
