Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of mgainty@hotmail.com designates
 65.55.111.86 as permitted sender)
Message-ID: <BLU142-W311726E036E0ECEF887CDCAE8F0@phx.gbl>
Content-Type: multipart/alternative;
	boundary="_49de0fc1-dd90-47af-96a9-f5583f5519ae_"
From: Martin Gainty <mgainty@hotmail.com>
To: Tomcat Users List <users@tomcat.apache.org>
Subject: RE: interaction between .forward() and <security-constraint>
Date: Sat, 4 Sep 2010 20:15:51 -0400
Importance: Normal
In-Reply-To: <4C82D507.1040701@apache.org>
References: <4C82034B.2070306@googlemail.com>
 <99C8B2929B39C24493377AC7A121E21F99C16494CC@USEA-EXCH8.na.uis.unisys.com>
 <4C826847.8050100@googlemail.com>
 <4C827363.1030605@ice-sa.com>,<4C82D507.1040701@apache.org>
MIME-Version: 1.0

--_49de0fc1-dd90-47af-96a9-f5583f5519ae_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable


far easier to implement than HTTPS
what can MIM access with just the session-id?
is this comparison DIGEST vs HTTPS documented

Martin
______________________________________________=20
Verzicht und Vertraulichkeitanmerkung/Note de d=E9ni et de confidentialit=
=E9

Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaeng=
er sein=2C so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiter=
leitung oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient l=
ediglich dem Austausch von Informationen und entfaltet keine rechtliche Bin=
dungswirkung. Aufgrund der leichten Manipulierbarkeit von E-Mails koennen w=
ir keine Haftung fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut =EAtre privil=E9gi=E9. Si vous n'=EAtes=
 pas le destinataire pr=E9vu=2C nous te demandons avec bont=E9 que pour sat=
isfaire informez l'exp=E9diteur. N'importe quelle diffusion non autoris=E9e=
 ou la copie de ceci est interdite. Ce message sert =E0 l'information seule=
ment et n'aura pas n'importe quel effet l=E9galement obligatoire. =C9tant d=
onn=E9 que les email peuvent facilement =EAtre sujets =E0 la manipulation=
=2C nous ne pouvons accepter aucune responsabilit=E9 pour le contenu fourni=
.


=20

> Date: Sun=2C 5 Sep 2010 00:23:51 +0100
> From: markt@apache.org
> To: users@tomcat.apache.org
> Subject: Re: interaction between .forward() and <security-constraint>
>=20
> On 04/09/2010 17:27=2C Andr=E9 Warnier wrote:
> > Digest authentication is not very popular=2C and rather a pain to
> > implement yourself.
> > The reason why it is not very popular is that it is a bit of a halfway
> > solution : it does avoid user passwords to be transmitted in clear over
> > the net=2C but it is not safe for man-in-the-middle attacks (someone ca=
n
> > record the digest=2C and use it to authenticate later as that user).
>=20
> No they can't. DIGEST is secure against such an attack. Any session ID=2C
> however=2C will be vulnerable.
>=20
> > And
> > it still leaves the subsequent conversation unencrypted.
>=20
> True.
>=20
> > If you really need security=2C then you should run your entire site und=
er
> > HTTPS.
>=20
> It depends on what you are trying to protect. Generally=2C this is true
> but there will be edge cases where DIGEST is sufficient.
>=20
> Mark
>=20
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe=2C e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands=2C e-mail: users-help@tomcat.apache.org
>=20
 		 	   		  =

--_49de0fc1-dd90-47af-96a9-f5583f5519ae_--