From: Rainer Frey <rainer.frey_at_inxmail.de>
Date: Thu, 28 Apr 2011 08:52:33 +0200

Hi,
I'm using Glassfish 3.0.1 fronted with Apache and mod_proxy_http.
One application may be accessed with HTTPS only. I terminate SSL in Apache, and use plain HTTP between Apache and Glassfish on the local machine. The application is accessed via a dedicated host name, configured as SSL-only VHost in Apache, using default port 443. I use ProxyPreserveHost in Apache, so the original host header is available.

How can I achieve:
a) that all redirects (and other generated absolute URLS) from Glassfish use HTTPS scheme?

b) even enforce a transport-guarantee=CONFIDENTIAL constraint in the web application?

With tomcat, I would achieve that with a dedicated connector that is accessible from localhost only, with scheme=https, secure=true, SSLEnabled false, and make sure Apache proxies to this port only from SSL VHosts. That way tomcat receives the requests via plain HTTP, but the Servlet API considers them as secure. Is there an equivalent in Glassfish?

Is there any difference in possible solutions between Glassfish 3.0.1 and Glassfish 3.1?

Thanks
Rainer Frey