apache - Fail to secure the SSL in tomcat -
our architecture is:
external users<---https--->web server(apache http server)<----->webapp server (tomcat)
we fail pass ibm appscan, used detect security defects in webapp server, because finds our tomcat server.xml file not added secure="yes" attribute in our port.
however secure="yes" attribute should not added tomcat server.xml file because not need secure connection between web server , webapp server.
how can fix issue? there secure="yes" attribute can added configuration file of web server(apache http server)?
thanks & regards,
gordon
if users accessing tomcat (indirectly) through apache httpd using tls (https:// url) entirely appropriate set secure="true"
in <connector>
. tells web application request being received secure when not (e.g. using plain-http between httpd , tomcat).
so, if have set scheme="https"
on <connector>
want set secure="true"
.
this not configuration change can make on apache httpd side... must done in tomcat.
Comments
Post a Comment