Tomcat HTTPS Session Management

[nullmonkey]

I am currently working on a site (set of Java Servlets leveraging XML/XSL to generate HTML) and am trying to understand the Tomcat/HTTPS paradigm. The servlets are broken up into those that do not require encryption (IE generate the index and download pages) and those that do (IE register, log in, edit profile). Is there an elegant way to terminate an HTTPS session with the logout servlet? I can associate logging in with the creation of an HTTPS session by forcing those servlets that deal with account information to use HTTPS in web.xml however I don't have a good way to end a session with logout.

 

[vkha]

I have searched the forums before with the same question. It's ugly but I do believe you will have to hardcode http:// to terminate https. I haven't tried it but you can hack it by dynamically getting the request.url and create a formatter that appends the http:// to it.

Good luck.

, Vincent