securing a non-login protected page with SSL

Matthew Hixson <[email protected]> Thu, 6 Nov 2008 17:42:32 -0800
Newsgroups gmane.comp.java.securityfilter.user
Message-ID <[email protected]>
I have a page that we do not require people to login, but we do  
require the form data to be submitted over SSL.  We would also like to  
serve this page via SSL so that our users are comfortable submitting  
their data to it.

I was trying something like this:

<security-constraint>
     <web-resource-collection>
       <web-resource-name>signup page</web-resource-name>
       <url-pattern>/foo/signup/index.jsp</url-pattern>
       <http-method>DELETE</http-method>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
       <http-method>PUT</http-method>
     </web-resource-collection>
     <user-data-constraint>
       <description>SSL required</description>
       <transport-guarantee>CONFIDENTIAL</transport-guarantee>
     </user-data-constraint>
   </security-constraint>

But that appears to have no effect on the serving of that page.

Is it possible to secure a page with SSL that is not also behind a  
login-protected URL pattern?
   -M@

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/