8:20 p.m.
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.2.0.BETA1
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:02 p.m.
New subject: [jbossseam-issues] [JBoss JIRA] Updated: (JBSEAM-741) auto-redirect to HTTPS
[ http://jira.jboss.com/jira/browse/JBSEAM-741?page=all ]
Gavin King updated JBSEAM-741:
------------------------------
Fix Version/s: 1.1.6
(was: 1.2.0.BETA1)
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.1.6
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:18 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-741) auto-redirect to HTTPS
[ http://jira.jboss.com/jira/browse/JBSEAM-741?page=comments#action_12352316 ]
Shane Bryzak commented on JBSEAM-741:
-------------------------------------
This kind of switching between http and https seems to have been a sore point for JSF for
quite some time. I'm not sure exactly how we'll support this, because I don't
think it's a simple matter of redirecting to http/https for certain views. Maybe
doing this is part of the solution, however more research is needed to determine what else
is required. One thing I did find is a form control in the myfaces sandbox
(http://myfaces.apache.org/sandbox/form.html) that allows a "scheme" to be
specified, e.g. <s:form scheme="https"> - maybe we need something
similar.
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.1.6.GA
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:10 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Updated: (JBSEAM-741) auto-redirect to HTTPS
[ http://jira.jboss.com/jira/browse/JBSEAM-741?page=all ]
Gavin King updated JBSEAM-741:
------------------------------
Fix Version/s: 1.1.7.GA
(was: 1.1.6.GA)
slip
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.1.7.GA
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:17 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-741) auto-redirect to HTTPS
[ http://jira.jboss.com/jira/browse/JBSEAM-741?page=comments#action_12352320 ]
Shane Bryzak commented on JBSEAM-741:
-------------------------------------
Ok, so the initial strategy we're going to go with for this issue is:
1) Write a servlet filter to redirect to http or https depending on what is being
requested.
2) Implement a form control that can either post to http or https, depending on the
scheme.
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.1.7.GA
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:21 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-741) auto-redirect to HTTPS
[ http://jira.jboss.com/jira/browse/JBSEAM-741?page=comments#action_12352771 ]
adsf adsf commented on JBSEAM-741:
----------------------------------
Just keep in mind that you open a security hole once you switch from https back to http!
I would like to suggest to introduce a second session cookie thats _only_ transmitted via
https (and created upon the first https request) - this can be verfied by the same filter
that redirects to http or https. Once the cookie is transmitted via http the session is
considered insecure and therfore has to be invalidated. This should work with every
browser / server (although I'm not 100% sure on it so you better check it another
time ;)).
If you are looking for examples you might have a look at ACEGI - they have a http
<-> https switching filter.
Last but not least I would like to request a scheme="https" attribute for s:link
too.
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.1.7.GA
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:35 p.m.
New subject: [jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-741) auto-redirect to HTTPS
[ http://jira.jboss.com/jira/browse/JBSEAM-741?page=comments#action_12353589 ]
Shane Bryzak commented on JBSEAM-741:
-------------------------------------
On hold until I get apache set up with a self-signed cert to test this stuff.. I need to
install FC6 on one of my servers, so this will take a day or two.
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.1.7.GA
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:38 a.m.
New subject: [jbossseam-issues] [JBoss JIRA] Closed: (JBSEAM-741) auto-redirect to HTTPS
[ http://jira.jboss.com/jira/browse/JBSEAM-741?page=all ]
Shane Bryzak closed JBSEAM-741.
-------------------------------
Resolution: Done
Done! No servlet filter required, redirection to the appropriate scheme performed in
Pages.java. Things that we won't do at this stage:
1) No special s:form control with schema support. Until we understand the requirements
for this and evaluate any alternatives this won't be implemented.
2) No schema attribute for s:link - instead the specified view will be used to determine
which scheme to use.
auto-redirect to HTTPS
----------------------
Key: JBSEAM-741
URL: http://jira.jboss.com/jira/browse/JBSEAM-741
Project: JBoss Seam
Issue Type: Feature Request
Components: Security
Reporter: Gavin King
Assigned To: Shane Bryzak
Fix For: 1.1.7.GA
We should make it easy to direct the request to https. We should also validate that
requests that *should* be https actually *are* https.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7006
days inactive
7027
days old
7 comments
4 participants
participants (4)
-
adsf adsf (JIRA) -
Gavin King (JIRA) -
Shane Bryzak (JIRA)
-
Shane Bryzak (JIRA)