Specifying a Secure Connection

<< Establishing a Secure Connection | Verifying SSL Support >>

Specifying a Secure Connection

Specifying a Secure Connection in Your Application
Deployment Descriptor

To specify a requirement that protected resources be received over a protected transport layer
connection (SSL), specify a user data constraint in the application deployment descriptor. The
following is an example of a web.xml application deployment descriptor that specifies that SSL
be used:

<security-constraint>

<web-resource-collection>

<web-resource-name>view dept data</web-resource-name>

<url-pattern>/hr/employee/*</url-pattern>

<http-method>GET</http-method>

<http-method>POST</http-method>

</web-resource-collection>

<auth-constraint>

<role-name>DEPT_ADMIN</role-name>

</auth-constraint>

<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

</user-data-constraint>

</security-constraint>

A user data constraint (<user-data-constraint> in the deployment descriptor) requires that
all constrained URL patterns and HTTP methods specified in the security constraint are
received over a protected transport layer connection such as HTTPS (HTTP over SSL). A user
data constraint specifies a transport guarantee (<transport-guarantee> in the deployment
descriptor). The choices for transport guarantee include CONFIDENTIAL, INTEGRAL, or NONE. If
you specify CONFIDENTIAL or INTEGRAL as a security constraint, that type of security constraint
applies to all requests that match the URL patterns in the web resource collection and not just to
the login dialog box.

The strength of the required protection is defined by the value of the transport guarantee.

Specify CONFIDENTIAL when the application requires that data be transmitted so as to
prevent other entities from observing the contents of the transmission.

Specify INTEGRAL when the application requires that the data be sent between client and
server in such a way that it cannot be changed in transit.

Specify NONE to indicate that the container must accept the constrained requests on any
connection, including an unprotected one.

The user data constraint is handy to use with basic and form-based user authentication. When
the login authentication method is set to BASIC or FORM, passwords are not protected, meaning
that passwords sent between a client and a server on an unprotected session can be viewed and
intercepted by third parties. Using a user data constraint with the user authentication

Establishing a Secure Connection Using SSL

The Java EE 5 Tutorial · September 2007

786