[JSPWIKI-212] transport-guarantee CONFIDENTIAL should be removed from web.xml

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Won't Fix
• Affects Version/s: 2.6.2
• Component/s: Authentication & Authorization

Environment

apache-tomcat-6.0.16

• Assignee: Andrew R. Jaquith
• Reporter: Jürgen Weber
• Created: 17/Mar/08 10:27
• Updated: 15/Nov/21 14:15
• Resolved: 07/Oct/08 16:02

Description

The default web.xml of JSPWiki contains two times

<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>

for container managed authorization.

But by default Tomcat has not switched on SSL, and trying to log in to JSPWiki you get

Firefox can't establish a connection to the server at localhost:8443.

By default the user-data-constraint element should be removed as it makes activating container managed authorization unnecessarily difficult.

Especially as it is not easy or obvious to notice the connection between the cited error message and the user-data-constraint element.

Issue Links

• relates to: JSPWIKI-389 Container managed login fails with Geronimo