PDA

View Full Version : Redirects to https from http

aantono
Apr 6th, 2006, 03:51 PM
Keith,

I have the following requirement: when going through the flow, some actions require you to login in order to proceed. To handle that case I use ACEGI on the back-end (via the FlowListener) that basically checks for every flow and throws a Veto exception when the login is needed. In the flow definition I catch that exception and go to a login sub-flow. Inside that subflow I have a view that needs to render the page, but I want that to be https instead of http. Given the fact that I am already inside the request, the way I do it is by doing a redirect, the problem is, I can't specify the protocol with wich I want the redirect to proceed, or at least I can't seem to figure out how to do it. What would you suggest to handle this problem?

Thanks,
Alex

Flow Def. snippets
---------------------------------------------
<action-state id="addToCart">
<attribute name="authentication" value="ROLE_BOOK" />
<action bean="cartAction"/>

<transition on="success" to="cart"/>
</action-state>

<subflow-state id="login" flow="login">
<transition on="success" to="addToCart"/>
</subflow-state>

<exception-handler on="org.springframework.webflow.execution.EnterStateVe toException" to="login"/>

=== Login Flow ===
<flow start-state="renderLogin">

<view-state id="renderLogin" view="redirect:login">
<entry-actions>
<action bean="loginAction" method="setupForm"/>
</entry-actions>
<transition on="submit" to="bindLoginCriteria"/>
</view-state>

<action-state id="bindLoginCriteria">
<action bean="loginAction" method="bindAndValidate"/>
<transition on="success" to="doLogin"/>
<transition on="error" to="renderLogin"/>
</action-state>

<action-state id="doLogin">
<action bean="loginAction"/>
<transition on="success" to="success"/>
<transition on="error" to="renderLogin"/>
</action-state>

<end-state id="success" view="externalRedirect:/"/>

</flow>
kenevel
Apr 7th, 2006, 12:15 PM
It is possible to build web-applications without ever having to specify whether http:// or https:// should be used - you simply have to have two Apache virtual-hosts, one configured to redirect any traffic for URLs starting /secure/ to the other (secure) virtual host, and the secure virtual host to redirect any URL traffic not starting with /secure/ to the unsecured virtual host. Make sense?

However, in your problem, as part of a web-flow, you are using the same URL, which could conflict with the above configuration, so you probably want to do some sort of client-side redirection. You can do this with javascript by using the onload event, or you can simply set a redirect header in the page.


<html>
<head>
<meta http-equiv="refresh" content="0;URL='http://www.example.com/somepath'" />
</head>
<body/>
</html>


One caveat to note is how browsers treat session and persistent cookies for http:// and https:// urls - I've had trouble with tracking these and have had to encode the JSESSIONID into the url passed back yourself, as the c:url tag will only do so when a session or cookie is not present.
aantono
Apr 14th, 2006, 11:04 AM
Has there been any thought to add secureRedirect: option to enable the port switching? When working with security, it is very important sometimes to make sure that your view gets rendered via SSL. The rules are quite simple, if you are http (any port) then secureRedirect should switch you to https (any port + 363). i.e. (80 => 443)

Thanks,
Alex