Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: local policy)
Message-ID: <4850D7F5.3090600@ice-sa.com>
Date: Thu, 12 Jun 2008 10:01:57 +0200
From: =?ISO-8859-1?Q?Andr=E9_Warnier?= <aw@ice-sa.com>
User-Agent: Thunderbird 1.5 (Windows/20051201)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: Moving from a very old Tomcat to a new Tomcat.
References: <4837459D.3030704@seatadvisor.com> <48374AEC.8020906@cornell.edu>
 <48374CAB.2020507@seatadvisor.com> <483C14BE.2000007@christopherschultz.net>
 <484872A1.8090000@seatadvisor.com> <484882F3.708@seatadvisor.com>
 <484D5704.2000200@christopherschultz.net> <484DF0AE.2010703@SeatAdvisor.com>
 <484ED601.6040108@christopherschultz.net> <484ED801.1000002@seatadvisor.com>
 <484EDA35.9010701@christopherschultz.net> <484F9527.2050305@ice-sa.com>
 <484FD516.30501@christopherschultz.net> <g2pubh$1ci$1@ger.gmane.org>
 <4850ABE9.3010507@gmail.com>
In-Reply-To: <4850ABE9.3010507@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit


Bill Davidson wrote:
> Bill Barker wrote:
>  >This is correct. TC 3.2.4 never set the "secure" flag on that cookie,
>  >and TC 3.3.2 would only set it if you enabled an option in server.xml.
>  >This feature of TC is only on TC 4.0 and higher.
> 
> Thank you for confirming that.
> 
I personally believe that this was a long but very interesting thread, 
containing a lot of information from the best authorities and otherwise 
difficult to gather and bring together intelligibly, about Tomcat's 
handling of authentication and HTTP/HTTPS sessions, session-id cookies 
under HTTP/HTTPS (and their changes over Tomcat versions), transmission 
over mod_jk of the HTTPS nature of the session, browser handling of 
secure/non-secure cookies, etc..
Might this not usefully be brought together in a FAQ or article, which 
itself would be easy to find in the future ?
With everyone's permission, I would offer to write a draft, but I 
wouldn't have a clue as to how or where to publish this.
Mind you, considering the scope, I can't even think of an appropriate 
title. Java Servlet Specification for Dummies ?

Andr�


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org