Web.xml, struts and ssl

Question

Hi there,
on our projects web pages we use struts, to combine the html of our pages with the java code behind. To enable SSL I added a security constraint to the web.xml:
     <security-constraint>
          <display-name>SSL Constraint</display-name>
          <web-resource-collection>
               <web-resource-name>secured login resource</web-resource-name>
               <description></description>
               <url-pattern>/index.html</url-pattern>
               <url-pattern>*.do</url-pattern>
               <http-method>GET</http-method>
               <http-method>PUT</http-method>
               <http-method>POST</http-method>
          </web-resource-collection>
          <auth-constraint>
               <description></description>
               <role-name>authenticatedUser</role-name>
          </auth-constraint>
          <user-data-constraint>
               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
          </user-data-constraint>
     </security-constraint> Some of our web pages need to use no SSL. So I added (for first testing) a second security constraint to the web.xml and defined which pages should be without SSL:
     <security-constraint>
          <display-name>No-SSL Constraint</display-name>
          <web-resource-collection>
               <web-resource-name>businesstransaction resource</web-resource-name>
               <description></description>
               <url-pattern>*.go</url-pattern>
               <http-method>GET</http-method>
               <http-method>PUT</http-method>
               <http-method>POST</http-method>
          </web-resource-collection>
          <auth-constraint>
               <description></description>
               <role-name>authenticatedUser</role-name>
          </auth-constraint>
          <user-data-constraint>
               <transport-guarantee>NONE</transport-guarantee>
          </user-data-constraint>
     </security-constraint>As you can see, I exchanged *.do with *.go for testing. I simply defined all actions I want to be used without SSL with a .go instead of a .do in the struts.config.
In principle it works, but there is a problem: The default behaviour for struts seems to be that the name of the new action is posted in the url at the end of the standard starting url.
Our url starts with https://localhost:9443/client-web/, and whatever action I start, this url text in the browser window never changes, regardless of wether the next action would be protected or not.
First I thought my url pattern would be wrong, or the user or whatever. But then I found out, that when changing the url in the browser window by hand to http://localhost:9080/client-web/ it works. The web page then is without SSL active. And when I manually change the url while viewing a page that is meant to be SSL protected, the browser automatically changes to the SSL adress.
But then again, moving to a page without SSL does not enforce the browser to change its adress to the no SSL String. So again, SSL is active though a non secure access would be allowed.
Anybody has any idea how to change this default behaviour? It would be important to not only tell the server that non secure would be ok, but to actually USE non secure connection automatically.
The internet explorer is not able to upload files in SSL mode (though any other browser is able to), and our customer insists on using IE. And to tell the users "oh, just edit the line there in the window manually and reload the page will help ... or use Firefox" will not be a suitable solution.
Regards, Rommie.

Answer 1

There is a plugin called sslext which will do most of what you need.
http://sslext.sourceforge.net/
I think the last time I used it I made some changes to the plugin source so that I could force non-ssl to be the default behavour unless SSL was explictily stated in struts.config, but can't remember for sure. Bottom line is it will do most of what you need and can probably be modified to do the rest without too much trouble.