Securing a Tomcat Webapp

If you require a webapp to always run in https mode using a SSL key, then you need to add the following to your WEB-INF/web.xml configuration.

<security-constraint>
    <web-resource-collection>
        <web-resource-name>jsp</web-resource-name>
        <url-pattern>*.htm</url-pattern>
        <url-pattern>*.html</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>
Tagged with: General Java Tomcat

Related Posts

Where is the technology breakdown? Can AI help?

Where is the technology breakdown? Can AI help?

On a major financial institution website I was asked to complete a contact form. This organization has millions of existing customers. This is not a startup, yet the quality of work is something a junior developer would fail at an interview if they provided the answer.

Read more
Why My Mac Was Not Using Post-Quantum SSH With GitHub (And How I Fixed It)

Why My Mac Was Not Using Post-Quantum SSH With GitHub (And How I Fixed It)

In my previous post I made the case that the only post-quantum protection that counts is the algorithm your connection actually negotiates. This post is what happened when I checked my own laptop.

Read more
Q Day Is Coming: A Plain-English Guide to Post-Quantum Cryptography

Q Day Is Coming: A Plain-English Guide to Post-Quantum Cryptography

Every time you see the padlock in your browser, push code over SSH, or your application connects to a database, TLS or SSH is quietly doing two jobs. First, it proves you are talking to the real server and not an impostor.

Read more