Redirect HTTPS to HTTP

I. Scenario:
For enterprise intranet applications and websites with low security requirements, https-to-http requests are required. For example, if you only log on to the https protocol, all other requests go through the http protocol, you do not need to log on again after using the http protocol.

 

2. Solutions
Cookie validity period:

When the cookie is secure, after the server is redirected from the https protocol to the http protocol, the cookie will not be sent to the server with the request.
When the cookie is not secure, when the server is redirected from http to https, the cookie will not be sent to the server with the request.
Therefore, the solution is to construct a non-secure cookie (including session id information) and a non-secure cookie (including session id information) after https authentication ), in this way, the session will remain valid after the page Jump, so as to achieve the effect of no login after https redirection to http.

 

　　

 

The figure does not describe the redirection of web containers in detail, but only describes the implementation process of protocol conversion.

Key points:

Redirection jump is implemented in the page, not in the Authenticator implementation, nor in the Filter implementation, because Response has been commit.

Filter to add the logic of non-Secure cookies. Code:

　　

[Java]
Import java. io. IOException;
 
Import javax. servlet. Filter;
Import javax. servlet. FilterChain;
Import javax. servlet. FilterConfig;
Import javax. servlet. ServletException;
Import javax. servlet. ServletRequest;
Import javax. servlet. ServletResponse;
Import javax. servlet. http. Cookie;
Import javax. servlet. http. HttpServletRequest;
Import javax. servlet. http. HttpServletResponse;
Import javax. servlet. http. HttpSession;
 
Public class HttpsCookieFilter implements Filter {
 
@ Override
Public void destroy (){
 
}
 
@ Override
Public void doFilter (ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {

Final HttpServletRequest httpRequest = (HttpServletRequest) request;
Final HttpServletResponse httpResponse = (HttpServletResponse) response;
Final HttpSession session = httpRequest. getSession (false );
 
// Servlet3
If (session! = Null ){
System. out. println ("HttpsCookieFilter set session cookie :"
+ Session. getId ());
Final Cookie cookie = new Cookie ("JSESSIONID ",
Session. getId ());
Cookie. setMaxAge (-1); // no store
Cookie. setSecure (false );
Cookie. setPath (httpRequest. getContextPath ());
Cookie. setHttpOnly (true );
HttpResponse. addCookie (cookie );
}

// Servlet2
// HttpResponse. addHeader (
// "Set-Cookie ",
// "JSESSIONID =" + session. getId () + "; Path ="
// + HttpRequest. getContextPath () + "; HttpOnly ");


Chain. doFilter (request, response );

 
}
 
@ Override
Public void init (FilterConfig arg0) throws ServletException {
}
 
}