重定向到HTTPS时丢失请求属性

Question

I am trying to implement login throught SSL on Tomcat. The login servlet is called IniciarSesion, so I add the following to the web.xml:

<security-constraint>
            <web-resource-collection>
                <web-resource-name>Seguridad en Acceso</web-resource-name>
                 <url-pattern>/IniciarSesion</url-pattern>
            </web-resource-collection>
            <user-data-constraint>
             <transport-guarantee>CONFIDENTIAL</transport-guarantee>
            </user-data-constraint>
</security-constraint>

The problem now is that when i try to get the input password by doing:

String nick=(String)req.getParameter("login");

This returns null, the request parameter is losing when redirirecting from http to https.

How can i solve this?

Answer 1

It sounds as if your login page (where "login" is defined) is not protected. When it hits your /iniciarSesion servlet via HTTP, tomcat performs an HTTP REDIRECT to the SSL site. True redirects do not preserve the data originally sent to the server, thus you lose the data. My suggestion is to either include your login page in the CONFIDENTIAL scope.

Answer 2

The whole point of SSL is to secure the transport. If you send login credentials first over http then it makes no sense to redirect to https since you will already have sent the information "in the clear". What you do is post your login-form to the https URL, either by setting the form url explicitly, or by loading your login-page over https. This would involve adding the login-page as a protected resource, just like your login servlet.