[STR-370] Allow Secure Form Submittal with <html:form> tag

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Won't Fix
• Affects Version/s: Nightly Build
• Component/s: Tag Libraries
• Environment: Operating System: All; Platform: All
• Bugzilla Id: 4744
• Assignee: Unassigned
• Reporter: John Bauer
• Created: 08/Nov/01 16:56
• Updated: 16/Feb/11 19:45
• Resolved: 23/Apr/06 04:35

Description

I would suggest a feature to the form tag to provide for specifying the
scheme (http/https) to use for form submittal.

In many cases, it is desired to have your home page non-HTTPS for a variety
of reasons (speed, search engines, etc.), but also provide a login form as
well. This would require the form to be submitted using HTTPS for secure
sites.

Here is the original problem reported to STRUTS-USER:
I have an unsecure web page with a logon form on it. When the user clicks
"Logon", I want the form submitted to a struts action using HTTPS. With a
normal form, this is trivial, just provide a full URL (with the scheme and
hostname)for the action and it works just fine.

With a Struts-based form, when I try the same thing, I get the following
error:

Wed Nov 07 16:35:33 EST 2001:<E> <WebAppServletContext-General> Root cause
of ServletException
javax.servlet.jsp.JspException: Cannot retrieve mapping for action
/https://localhost:7001/acti
on/login

It is assuming that the action is the relative mapping instead of the full
URL. How does one submit a struts form using HTTPS? Note that I do not
want to redirect to HTTPS, since that would cause the userid and password to
be sent in the clear.