java web service calls by applet

Question

I have an applet loaded by browser.
This applet makes web service calls to server.
If I sign the applet and download it via https by the server, if then I make a web service call, would it be possible to reuse the existing ssl session or will the https would have to be reestablished?
I think that the https (ie ssl handshake) would have to be reestablished since the initial connection was made by browser. Is this the case?
If yes, then is there a way to avoid reauthentication when the user starts using the applet? Ie reuse the previous ssl connection, or is it impossible? BTW the web service stack is axis2.

Thanks

Answer 1

https and authentification are different things. Of course they are working together when you authentificate with user/password over https.

https can be used for authentification when client authentification is enabled. So the client must send a valid (signed) certificate to the server. But i supose you have a user/password over https authentifation method.

Once the browser has logged in, normally the server creates and holds a session and the browser receives a session cookie. That cookie will be send on consecutive requests after login (still encrypted by https).

If you pass the session cookie to the applet the applet can reuse the session.

Update

Impossible to explain you this in detail. You should search and read for Java Applet communication .

• You can call methods of the applet from javascript and access the web page/browser state from the applet (Applet.getAppletContext()).

• You may call the applet with a parameter that contains the session id.

The session cookie name may be JSESSIONID when the web server is a servlet container.

If your web server is a servlet container then you can pass the session id in diferent ways: as cookie in the request header or coded into the URL (URL rewriting).