Keeping session alive when going between HTTP and SSL

[mluken]

This seems pretty easy in theory to me, but I am stumped. I have a webapp running on Tomcat 4.1. A user signs in and I authenticate them based on a MySQL database and all that fun stuff, and add their UserID to the HttpServletRequest.Session if their signon is successful. This is non-secured and running on port 8080. I do not need this section to be secured. However, there is another portion of the site that DOES need to be secured with a certificate. The certificate is installed, and Tomcat is configured to redirect to port 8443 for secured requests. This is working as expected, EXCEPT once they click on that secured link, their Session does not carry over. I understand why, as the session is set on 8080 and the secured site is on 8443. But there has to be a way to keep that session alive?

This seems so simple to me but I am striking out! Any help or thoughts would be greatly appreciated!

Thanks!

 

[vkha]

The link that goes to the secure area is set by security constraint in web.xml or is it a link starting with https://
?

 

[mluken]

It is a link that I click on. So I am on:

http://www.mysite.com/servlets/myservlet?page=page1

and on that page there is a link to:

https://secure.mysite.com/servlets/myservlet?page=2

Both pages call the same servlet. Tomcat forwards the second page to port 8443 as specified in Server.xml using redirectPort=4333. However, when I get to page2, the session variables that were set in page1 are dead.

 

[vkha]

Maybe try going to

https://www.mysite.com/servlets/myservlet?page=2

instead of

https://secure.mysite.com/servlets/myservlet?page=2

because the browser might be killing the session because it thinks its going to a new website.

 

[vkha]

Check this out

http://forum.java.sun.com/thread.jspa?threadID=197150&tstart=0

I just stumbled onto the problem myself and am looking for a fix too lol.

 

[vkha]

The just implemented the solution found below and it works !

Re: Redirect from HTTPS to HTTP on Tomcat 4 problem
Author: r_klemme Dec 3, 2001 8:54 AM (reply 2 of 12)
hm, i do not have a solution but typically you don't do a secure login and then redirect to an insecure page. the normal scenario is to log into a secure page and stay secure. as far as i know HTTPS establishes its own kind of session which might be connected to the servlet session somehow. if that is the case then it's clear, that the HTTPS session is lost when you switch over to HTTP.

what could work is to have an initial page with HTTP, which creates a session (creating a cookie on in the browser or switching to URL rewriting) and only after that switch to HTTPS (and maybe switch back).

i guess you'll have to try out. sorry.

robert