Is it necessary to set the security constraint in web.xml if I'm using a loadbalancer to redirect HTTP traffic to HTTPS?
For example, following this post:
<profile>
<id>local</id>
<properties>
<transport.guarantee>NONE</transport.guarantee>
</properties>
</profile>
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Context</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>${transport.guarantee}</transport-guarantee>
</user-data-constraint>
</security-constraint>
My local environment isn't detecting the profile property for transport.guarantee == NONE, so I keep getting 403.
Is this is even necessary if the loadbalancer is enforcing a secure connection? And if it is, why would the generated web.xml have the correct transport-guarantee value (NONE) from the profile but still deny access?
Aucun commentaire:
Enregistrer un commentaire