Java Web应用程序同时提供安全和不安全的资源

Question

I am writing a Java web app (spring 3.2).

Basically, I have several sites that need to access my web service. These sites are a mixture of both secured (ssl) and insecured. I have an endpoint /validate/{id} that should respond to both secured requests

 (https://localhost:8443/ws/validate/123 and http://localhost:8080/ws/validate/123)

How do I do this? I've added

<security-constraint>
    <web-resource-collection>
        <web-resource-name>ws</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

to my web.xml, but that only forces ssl ( calls to 8080 get a 302 FOUND response with a Location header pointing to 8443.

How do I allow both secured and insecured requests on the same endpoint (with different ports)?

Answer 1

 <transport-guarantee>NONE</transport-guarantee>

似乎已经解决了问题...