apache - Fail to secure the SSL in tomcat -


our architecture is:

external users<---https--->web server(apache http server)<----->webapp server (tomcat)

we fail pass ibm appscan, used detect security defects in webapp server, because finds our tomcat server.xml file not added secure="yes" attribute in our port.

however secure="yes" attribute should not added tomcat server.xml file because not need secure connection between web server , webapp server.

how can fix issue? there secure="yes" attribute can added configuration file of web server(apache http server)?

thanks & regards,

gordon

if users accessing tomcat (indirectly) through apache httpd using tls (https:// url) entirely appropriate set secure="true" in <connector>. tells web application request being received secure when not (e.g. using plain-http between httpd , tomcat).

so, if have set scheme="https" on <connector> want set secure="true".

this not configuration change can make on apache httpd side... must done in tomcat.


Comments

Popular posts from this blog

java - Plugin org.apache.maven.plugins:maven-install-plugin:2.4 or one of its dependencies could not be resolved -

Round ImageView Android -

How can I utilize Yahoo Weather API in android -