Maintaining a session between HTTP and HTTPS

[Robert Mark Bram]

Hi All,

1) In a web app, is it standard to use HTTPS only for those pages that
are transmitting data you want to encrypt (e.g. user name and
password) and use HTTP for everything else?

2) If you do this, are there any issues with sharing the session? I.e.
can my JSPs hit through HTTPS still access the same session variables
created and modified by my JSPs hit through HTTP?

Thanks for any advice!

Rob

 

[Pushkaraj]

1. Protocol to use depends on sensitivity of your data, we use HTTPS
for this, and for normal data prefer HTTP as it is fast and puts less
overhead on Server/Client.

2. I am not sure about your environment, if you as using J2EE
webcontainer for deploying the application, then webcontainer manages
your session, independent of you use HTTPS or HTTP protocol.

Hope this answers your questions,

Pushkaraj

 

[Lew]

1. Protocol to use depends on sensitivity of your data, we use HTTPS
for this, and for normal data prefer HTTP as it is fast and puts less
overhead on Server/Client.

2. I am not sure about your environment, if you as using J2EE
webcontainer for deploying the application, then webcontainer manages
your session, independent of you use HTTPS or HTTP protocol.

The information is correct, but please do not top-post.

 

[Robert Mark Bram]

Hi Pushkaraj,

1. Protocol to use depends on sensitivity of your data, we use HTTPS
for this, and for normal data prefer HTTP as it is fast and puts less
overhead on Server/Client.

2. I am not sure about your environment, if you as using J2EE
webcontainer for deploying the application, then webcontainer manages
your session, independent of you use HTTPS or HTTP protocol.

Hope this answers your questions,

It does - thank you very much!

Rob

 

[dcest61]

Hi Pushkaraj,


It does - thank you very much!

Rob

I'll just add, depending on your web container, you'll likely have to do
some extra server configuration to ensure that web app information
(including sessions) is shared across HTTP and HTTPS requests. It's usually
not onerous at all.

AHS

 

[Pushkaraj]

The information is correct, but please do not top-post.

OK Lew will take care in future