WEB_CAT User Notifications different for http and https

Hi,
We're using a AsyncOS7.5 on Ironport S360.
When a user accesses a URL which according to URL Category Filtering is forbidden
(e.g. www.mydrive.ch) then the Error Message when using http is:
This Page Cannot Be Displayed
Based on your organization's policies, access to this web site (http://www.mydrive.ch/ )
has been blocked because the web category .... is not allowed.
Date:
Username:
Source:
URL:
Category:
Reason:
Notification:
If on the other hand the user uses https then the error message looks like this:
The proxy server is refusing connections
Firefox is configured to use a proxy that is refusing connections.
- Check the proxy settings ...
- Contact your network administrator ...
Does anyone know why is that and how can I make it use the former notification for both cases?

Hi Jannis,
In HTTP policy or access policy, the returned log from a blocked traffic due to category is BLOCK_WEBCAT and you will also see a TCP_DENIED/403 in the line.
In decryption policy for HTTPS traffic, the returned log from a blocked traffic due to category is DROP_WEBCAT, and you will so see a TCP_DENIED/403 in the response.
With policy trace:
For HTTPS traffic it should reply with information that indicates that the HTTPS request dropped based on URL category.
And for HTTP traffic, it should reply with "Request blocked based on URL category"
Also, you can determine which policy that triggers the blocking, whether it is the access policy (for HTTP) or decryption policy (for HTTPS).
thanks,
Donny

Similar Messages

IWeb protocol support for anything OTHER than http and https

I am extremely disappointed in iWeb. It doesn't even seem to be able to do very simple things.
All I want to do is to create HTML links to external pages with protocols other than "http" and "https" and it always prepends "http" to the beginning of the URL. This is really really really annoying.
Apple I hope you are paying attention. iWeb is poorly designed. You are trying to anticipate what end users want...this is a development practice right from the Microsoft Windows Developer book. I sure how the next update to iWeb works properly. I'm so upset about all this...I can't publish podcasts to the web because of all the foolishness with how you handle that, and the confusing directory name issues.
My podcast URL looks like this:
http://itpc://www.mysite.com/podcast/News/rss.xml
I tried (unsuccesfully) to manually create the podcast since the automated version created this:
itpc://www.bradyconsult.com/podcast/podcast/News/rss.xml
I'm sure I could fiddle with iWEb and get this to work, but why should I? I've already fiddled with it and simple changes to my site structure totally screw this up. Not to mention, that when it did work, it didn' t even post all my podcasts!!! It skipped the first one and the last one.
And, for those wondering, i'm not technically clueless. I have a podcast working just fine on two other sites. The appeal to iLife with iWeb and the new podcast feature of GarageBand was to bring all this together in one easy to use, nice package. But it's not nice. Garageband's update is awesome! But iWeb and it's attempts to work with the other iApps is gruesome.
I expect this garbage from Microsoft...not Apple.
Can anyone recommend a workaround (and yes, I understand I can manually edit HTML...but I was hoping for a workaround within iWeb) to create html links with support for protocols (aside from http and https) ??
It's bad enough I have to publish to a folder and then FTP to my site since apple makes that exceedingly difficult to do (I'm sure to increase .mac sales) but all this other foolishness is just bunk. I feel ripped off on my iLife '06 purchase.
Grrrrrrr......
G5 Dual 2.3 GHz Mac OS X (10.4.5)

I don't know if this helps you any, but in my humble
opinion Drake is absolutely correct. iWeb really
wasn't designed for the pro site builder; it's just
an entry level site builder. Moreover, it isn't
really geared for the professional world of internet
marketing; I think it is really more for the home
and family group who have at least one thing in
common: Macs.
I don't think it was even designed for them. I mean, you can't create an ftp: link, you can't manage multiple site files, there's no way to add "aim:" or "yahoo:" links, etc. It's not mac's they're supporting. It's .mac in particular, maybe, if that.
The art is kinda nice, but really, the grief in trying to do simple things like a basic href is just absurd. I can do these things easily in Pages. iWeb should certainly be no more difficult.
Btw, I'm here because I have the same problem - overly restrictive URL's on hyperlinks. I'll probably solve my with a trivial sed script. But even that's tough because they mangle the url. It's not easy to find an encoding suitable for automatic post processing.
Automator anyone?

Clarification for HTTP and HTTPS Sender Adapter

Hello together,
after some investigating concering scenarios with HTTP and HTTPS sender there are still some points that are not absolutely clear for me.
I know that it is not necessary to configure an HTTP sender communication channel. However if I want to enforce HTTPS sender communication I think I need to add an HTTP sender communication channel with security settings enabled as well as a sender agreement.
To my understanding these settings are activated on the Adapter Engine (Java Stack), HTTP requests however call the ABAP stack directly. How does this work exactly?
Thank you very much for your additional explanation.

Hi,
see below is the format for HTTP URL
http://<hostname:port>/<path>?<query-string>
now query straing can only have values as given in the below link
http://help.sap.com/saphelp_nw2004s/helpdata/en/43/64db4daf9f30b4e10000000a11466f/content.htm
a way around can be to specify the payload for &party or &agency or &schema(if you are not using them) but then XI should be able to identify them correctly(which i m not sure how it will do),secondly the length can be a constraint coz if you add the whole payload ,the URL will become really long.
so i would suggest you not to use it but if you really have to,then explore it properly first and then only use
plz reward points
thnq

Configuring WCCP for http and https

How do I configure wccp on a 6509 to redirect http and https trafic to a S650. I am using the following config and http is working fine:
ip wccp version 2
ip wccp web-cache redirect-list aclwccp
interface Vlan23
description Rede Firewall
ip address 10.0.23.20 255.255.255.0
ip access-group 172 out
ip wccp web-cache redirect out
mls rp vtp-domain coc_block1
mls rp ip
mls netflow sampling
end
Should I config an other service for the https protocol?

Cecato,
The WSA can be configured to send 80 and 443 traffic, in the WCCP settings area (5.2.0+). There are some things you will need to be aware of before doing this though:
1. If you are on 5.2.0-x, you will not be able to inspect HTTPS traffic. Only version 5.5.0+ has the ability to decrypt HTTPS traffic. Because of this, it is not recommended to redirect port 443 on WSA version 5.2.
2. You will most likely need to specify a service ID other then web-cache. On most Cisco devices, web-cache is reserved for port 80 traffic only and cannot be changed. Any other service ID will work as you want it to.

Maintaining Sessions between http and https

I have a web application in which I want my users to view the login page over SSL and send the login request via SSL also, but then I want to revert back to http://
My problem is, and i've seen this problem on loads of boards with no real resolution, during the login I set some objects with in the session that are used to display information in other parts of the site... but the session object is being lost!!!
I am using Tomcat as my web server, I saw an article on JavaWorld titled "mix protocols transparently in web applications", and apparently to over come this problem if you are using WebLogic 6.1 there is a parameter in the weblogic.xml file that must be configured, but I cant find a similar one on Tomcat!!!
Thanks in advance

Thanks a million for the answer, I have got it working now, but I had to do something a little different for any one else who experiances this problem I'll go through it... I set an attribute in the context which was named the the value of the current session id and contianed the session object. Then when leaving the login handeling in my dispatcher servlet I apended the session id to the url of the next jsp called. In this jsp then I retrived the "secure session" object from the context, this so far is what you suggested.
But then I had to loop through "non secure session" object's attributes and set them in the "non secure session" object, that is I was not just able to reset the "non secure session" object equal to the "secure session" object as when I went on to the next page it was reset to the "non secure session" object again!
The fact that the session object is changed when moving between http and https is (according to Tomcat buglist) a bug of Tomcat 4.1 and did not occur in tomcat 3.2

Does Office365 EWS provides Push Notification service for Contacts and Calendar Events?

Even though there are REST API's for performing PUSH and PULL operations for Office365(online), I am still looking the old EWS approach where in I want to subscribe for PUSH notification service for Contacts, Calendars and Mail Boxes.
Can any one suggest if there is a way to achieve this.

I posted an answer in your Stack Overflow post.
http://stackoverflow.com/questions/27837887/does-office365-ews-provides-push-notification-service-for-contacts-and-calendar/27844747#27844747

How to protect both access (http and https) with a Policy Agent

Hi,
During the installation of a web Policy Agent (i.e. Policy Agent for IIS) we have to choose the protocol (and port) of the web server we want to protect.
If we have an IIS with secure (https) and non secure (http) applications, how we manage this scenario with the policy agent?
Regards,

Hi,
Finally, i have installed the agent in IIS5 in the non secure port (http) and in fact it detects both access (http and https) fine.
The problem now is that if i try to access to a non secure url ( http://mynonsecureapp.com ) all works fine, the agent redirects to https://myaccessmanager.com:443/amserver/UI/Login?goto=http://mynonsecureapp.com but when i try to access to a secure url ( https://mysecureapp.com ) the agent try to redirects me to: https://myaccessmanager.com:443/amserver/UI/Login?goto=http://mysecureapp.com (notice that the agent removes the 's' in the url).
The amAgent log file shows:
+2008-07-17 09:44:08.296MaxDebug 656:d8f6b0 PolicyAgent: am_web_is_notification(), https://sigcit.agp.gva.es:443/fullcitriweb is not notification url http://sigcit.agp.gva.es:80/amagent/UpdateAgentCacheServlet?shortcircuit=false.+
+2008-07-17 09:44:08.296 Warning 656:d8f6b0 PolicyAgent: OnPreprocHeaders(): Access Manager Cookie not found.+
+2008-07-17 09:44:08.296 Debug 656:d8f6b0 PolicyAgent: am_web_is_access_allowed(): url 'https://sigcit.agp.gva.es:443/fullcitriweb' path_info ''.+
+2008-07-17 09:44:08.296MaxDebug 656:d8f6b0 PolicyAgent: am_web_is_access_allowed(): processing url http://sigcit.agp.gva.es:80/fullcitriweb.+
+2008-07-17 09:44:08.296 Debug 656:d8f6b0 PolicyAgent: am_web_is_access_allowed(): client_ip 172.27.65.62 not found in client ip not enforced list+
Any ideas?
Regards,
Edited by: idm_oceanic on Jul 17, 2008 1:33 AM

JSF / Switch between HTTP and HTTPS

Hello!
I want to switch between HTTP and HTTPS using JSF.
Under Apache Struts framework I can use struts extension "sslext.jar" to configure switching between http and https in one web application.
e.g. Login-jsp should be secured, all other jsp's should run unsecured.
Any ideas?
regards
Harald.

Thanks,
I made the necessary enhancement for the second phase, password confirmation required when return to SSL zone after leaving it after a succesful login.
I did the following:
1) create a class in the application scope and/or singleton class with the servlet paths that require SSL
2) create a plugin that reads ActionConfigs from the ModuleConfig
3) create a filter that sets a request scope flag that says that password must re-entered.
Code Extracts:
1) MainshopContainer application level parameter singleton class:
private static HashMap sslZoneMap = new HashMap(50); // key = servlet path of request, example /login.do
public boolean isInSSLZone(String servletPath)
return this.sslZoneMap.containsKey(servletPath);
public void addToSSLZone(String servletPath)
this.sslZoneMap.put(servletPath,null);
public int getNumberOfActionsInSSLZone()
return this.sslZoneMap.size();
2) Struts plugin
add a call to loadSSLZoneMap in plugin init method:
loadSSLZoneMap(config, mainshopContainer);
private void loadSSLZoneMap(ModuleConfig config, MainshopContainer mainshopContainer)
throws ServletException
try {
ActionConfig[] actionConfigs = config.findActionConfigs();
for (int i = 0; i < actionConfigs.length; i++)
if (actionConfigs.getParameter().indexOf("/jsp/account/") < 0) // /account/* = URL path for SSL zone
// not found = not ssl zone
System.out.println("loadSSLZoneMap, following actionConfigs excluded from SSL Zone: "+actionConfigs[i].getPath());
else
// found = ssl zone
String servletPath = actionConfigs[i].getPath()+".do";
mainshopContainer.addToSSLZone(servletPath);
System.out.println("loadSSLZoneMap, following servletPath added to SSL Zone: "+servletPath);
System.out.println("loadSSLZoneMap, number of actions in SSL Zone: "+mainshopContainer.getNumberOfActionsInSSLZone());
catch (Exception ex)
ex.printStackTrace();
throw new ServletException("Exception caught in loadSSLZoneMap: "+ex.toString()+" Initialization aborted.",ex);
3)
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
String servletPath = req.getServletPath();
boolean secure= this.mainshopContainer.isInSSLZone(servletPath);
The wole picture:
The filter adds a RequestDTO object that includes all request parameters, one of them is the secure flag.
I have a session scope class UserContainer that includes all the session parameters, one of them is the lastRequestDTO.(last made request)
At the end of all my jsp's I set the lastRequestDTO variable.
In that method I set the passwordConfirmationRequired flag if needed:
public void setLastRequestDTO(RequestDTO _lastRequestDTO)
if (this.lastRequestDTO != null && this.lastRequestDTO.isSecure() != _lastRequestDTO.isSecure())
this.setPasswordConfirmationRequired(true);
this.lastRequestDTO = _lastRequestDTO;
I read the passwordConfirmationRequired in all my jsp's in the SSL zone that allow editing or deleting and if that flag is true, a valid password must be re-entered in order to make the updates.
When the password is OK I reset the passwordConfirmationRequired to false.
I need some help for the first phase, that is SSL setup for all actions related to jsp's with url path /account/*
I tought I could define it in the web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>All Account Related Pages</web-resource-name>
<url-pattern>/account/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
but that doesn't work and finnaly understood why:
Example: /WEB-INF/jsp/account/login.jsp corresponds to /login.do
The url pattern /account/* at the container level is never encountered.
Is it allowed to declare the following action path: /account/login instead of /login?
If yes I could add following prefix /account to all my action paths and forward paths and this could resolve my problem.
What's your opinion?
If no, would your library resolve this?
Will all the Struts/JSP/JSTL url generating tags pick-up the required protocol (http/https) according to your configuration file?
Regards
Fred

Why is the Amber update different for ATT and Chin...

Why is the Amber update different for ATT and China? For Lumia 520, it could tap to unlock but, in china, this function is disappeared disappear. Could you give an expain as the matching hardware, otherwise I think it's a definately discriminatory to Chinese.

Double tap to unlock is not available for any 520, anywhere in the world. See link below. You should always check first before making allegations.
http://discussions.nokia.com/t5/Nokia-Lumia/quot-Missing-quot-new-features-in-Amber/td-p/2061872

When we Use HTTPS and HTTP

Hi Frnds,
when we Use HTTP's and HTTP.
Can anyone explain...
Regards,
Raj

Hi
A general defination of HTTP and HTTPS would be :
HTTP
HTTP is the protocol that a web browser such as Internet Explorer uses to request a web page from a web server.
It can be "implemented on top of any other protocol on the Internet, or on other networks. HTTP only presumes a reliable transport; any protocol that provides such guarantees can be used."
HTTPS
HTTPS is an encrypted form of HTTP used for sending sensitive data like credit card numbers between the browser and the web server. This is also sometimes called Secure HTTP or SSL (which stands for Secure Sockets Layer).
All XI runtime components using the HTTP protocol support the encryption of the HTTP data stream by means of the SSL protocol, also known as HTTPS. HTTPS data streams are completely transparent to the Exchange Infrastructure.
To enable an HTTPS connection, two steps are required:
       1.      Both parties of an HTTP connection (that is, the HTTPS client and the HTTPS server) must be technically enabled.
       2.      The internal XI communications and the messaging communications must be configured in XI to use these HTTP connections.
In addition, for certain adapters you can enforce HTTP security for incoming messages.
Technically Enabling SSL
Whenever a hardware or software component is to be enabled for SSL, the client and the server part of an HTTP connection have to be enabled differently. Moreover, the technical configuration for HTTPS is different for XI ABAP and J2EE components. For more information, see Transport Layer Security.
HTTPS comes in two flavors, both ensuring the confidentiality of data sent over the network
●      Server authentication
Only the HTTP server identifies itself with a certificate that is to be verified by the client.
●      Client authentication
Additionally, the HTTP client identifies itself with a certificate that is to be verified by the server.
Hope this clears your doubts
Thanks
Saiyog

PORTAL ACCESS THROUGH HTTP and HTTPS BOTH

Hi,
Is it possible to make the portal listen on both http and https ports at the same time? What is the required configuration for the same?
Please let me know for any other details.
Any input is highly appreciated.
regards,
Chandra

Hello Chandra,
you can activate SSL in the J2EE engine and then you have both Protocolls avaliable. The documentaiton can be found at <a href="http://help.sap.com/saphelp_nw04/helpdata/en/f1/2de3be0382df45a398d3f9fb86a36a/frameset.htm">Configuring the Use of SSL on the SAP J2EE Engine</a>.
Regards
Gregor

WCCP Configuration HTTP and HTTPS

Looking for anyone that might have a clue in on this, im attempting to configure a pair of routers to use WCCP to redirect HTTP and HTTPS traffic to two content keeper devices. The network im building is going to be used for a guest internet connection where defining proxies on end devices would be unusable.
I'll drop the configs in below but for now what i have are 2 cisco 3925 routers configured for HSRP. 2 content keeps running squid for the cache engine. with my current configurations, I have wccp web-cache and wccp service 70 configured (all 4 devices are available/usable in both services). this is a layer 2 setup. HTTP traffic is picked up and redirected to the content keepers without issue. https traffic does not appear to be detected by the routers. I have chosen not to use ACLS for WCCP and use the redirect in because we want to capture http(s) traffic from all hosts.
for HTTP, I see hits counters rise on the router under show ip wccp, i see hit counters for the content keepers increase, i see http traffic on the firewall from the content keepers and I get the web page on the device
For HTTPS I do not see hit counters under wccp increase, I do not see any traffic on the content keepers bridge, and i see traffic on the firewall from the hosts orginal ip address.
interface0/2 internal LAN
interface 0/0 content keepers (no WCCP commands)
interface 0/1 gateway firewalls. (no WCCP commands
ip wccp check services all
ip wccp web-cache
ip wccp 70
interface GigabitEthernet0/2
description To Lan
ip address x.x.x.x
ip wccp web-cache redirect in
ip wccp 70 redirect in
standby 1 ip x.x.x.x
standby 1 priority 150
standby 1 preempt
duplex auto
speed auto
Global WCCP information:
    Router information:
        Router Identifier:                   x.x.x.2
    Service Identifier: web-cache
        Protocol Version:                    2.00
        Number of Service Group Clients:     2
        Number of Service Group Routers:     2
        Total Packets Redirected:            17999
          Process:                           0
          CEF:                               17999
        Service mode:                        Open
        Service Access-list:                 -none-
        Total Packets Dropped Closed:        0
        Redirect access-list:                110
        Total Packets Denied Redirect:       0
        Total Packets Unassigned:            0
        Group access-list:                   -none-
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total GRE Bypassed Packets Received: 0
          Process:                           0
          CEF:                               0
    Service Identifier: 70
        Protocol Version:                    2.00
        Number of Service Group Clients:     2
        Number of Service Group Routers:     2
        Total Packets Redirected:            0
          Process:                           0
          CEF:                               0
        Service mode:                        Open
        Service Access-list:                 -none-
        Total Packets Dropped Closed:        0
        Redirect access-list:                -none-
        Total Packets Denied Redirect:       0
        Total Packets Unassigned:            0
        Group access-list:                   -none-
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total GRE Bypassed Packets Received: 0
          Process:                           0
          CEF:                               0
Show details and show service attached.

Hello Josh,
1. Yes, port-specific ACL is not supported. But it is not a big problem. Usually on WCCP server you can configure very specific bypass (Cisco WSA supports that - do not know about Sophos). For bypassed traffic WCCP server will reinject that packet in GRE and send back to ASA which will decapsulate it and send as normal packets.
It's a good design, because you can have very granural bypass policy on WCCP server.
2. Yes, configuration is correct, although it's better to be more specific (not send all traffic to WCCP if there is no need for that).
3. Yes, you can use deny in redirect-list to exclude traffic.
4. WCCP keepalives are being send by WCCP server by default every 10 seconds. If ASA does not see that replies for some time it marks server as dead and uses other ones.
Michal

In OS 10.6 and Safari 6, http: and https: are no longer displayed.

In OS 10.6 and Safari 6, http: and https: are no longer displayed.
Can this behaviour be restored??
In 10.5.8 with Safari 5.x some sites will show up as https: while the same
site in Safari 6 may, or may not, show the grey or green box https: box.
Is this this a certificate problem?
Can I set the address bar to for the URL prefix?
I have both systems on separate disks and consistantly see this behaviour on some sites.
How can I feel assured that a site is or is not secure using Safari 6??
A relative also shares this same issue
Thanks for your Help!

Safari 6 : http is not shown in the URL (& Search combined) bar, but https is always shown, often with a symbol lock. The URL address font is black, after the / it is grey.
All as expected.
Best.

Separate Tomcat http and https access

Hi
I got tomcat running both http and https.
However, http://localhost:8080 and https://localhost:8433 are accessing the same page.
I need to separate them, to prevent from entering data using http://localhost:8080 by mistake.
Please help.
Cheer
T

there are 2 ways to only allow https access to your webapp
1:
stop tomcat listening on all ports except https port
2:
configure your webapp to only allow https access
http://marc.theaimsgroup.com/?l=tomcat-user&m=104951559722619&w=2

Mixed content - https and http

Guys and Gals -
I have a page that has mixed content - http and https. Users talk to my webserver
using https, which talks to the portal server using http.
The browser popups a warning saying that the site has mixed content. Is there
any way to prevent this warning from coming up? Anything I can do using a proxy
or something else?
Thanks
Niks

Neeraj Harlalka wrote:
It's probably not because your webserver is talking to App server on
http connection. It could be some images being referrenced from the
browser using non-secured protocol. Try using absolute path or code URLs
using jsp tags.
hope it helps
Guys and Gals -
I have a page that has mixed content - http and https. Users talk to my webserver
using https, which talks to the portal server using http.
The browser popups a warning saying that the site has mixed content. Is there
any way to prevent this warning from coming up? Anything I can do using a proxy
or something else?
Thanks
Niks

WEB_CAT User Notifications different for http and https

Similar Messages

Maybe you are looking for