2

Recently I had to redo something at work. It involved a servlet on Tomcat that accepted requests from external users (Connection A), which in turn connected via SOAP to a Web Service on the same box (Connection B). If Connection A used a secure connection, Connection B had to use one as well, otherwise my servlet would keep throwing connection errors and logging that the connection was reset. When I used an unsecure connection for both, they worked fine, so it was a certificate issue in the lab.

In general, I understand why mixed-content connections are discouraged or just refused by the client. But given that this was explicitly sent over localhost, it struck me as a bit of a hassle. So, if a connection is over localhost, why is this still neccessary?

5
  • "otherwise the servlet would refuse to connect." Which servlet? Your one in the Tomcat? Does it not create connection B? If so, what does "refuse to connect" mean? Which connection is "the client" creating? How could it know your servlet is using different security?
    – billc.cn
    Nov 6, 2015 at 15:11
  • @billc.cn, the client is a user's browser. The servlet is my servlet in Tomcat, and it just kept saying "connection reset" when I was using a secure connection. However, when I set both to use an unsecure connection, it worked fine. I'll update my question to include these. Nov 6, 2015 at 15:15
  • This in indeed strange. Not sure how the server for connection B know the security on connection A. Are the end points for both connections (A & B) on the same Tomcat?
    – billc.cn
    Nov 6, 2015 at 15:26
  • @bill.cn Indeed they are. This was installed as a sub-part of a system, which uses a specific general keystore instead of the default Java keystore. The cert for the box was installed in that keystore, although when generating that, I didn't specify localhost as a subject alternative name for the certificate. Which probably contributed to the connection being reset. Nov 6, 2015 at 16:25
  • @PhilipRowlands I think you have two separate questions here: 1) why is there a mixed-content policy at all 2) why does your servlet not work when calling a HTTP service while responding to a HTTPS request Nov 10, 2015 at 21:41

1 Answer 1

1

Mixed-content requests are generally discouraged as they leak information about secure content over insecure channels.

Localhost isn't considered special in that regard. In fact localhost can be seen as a higher risk since a page being able to load something on localhost could bypass the browser sandbox.

1
  • I had assumed that localhost was an exception. Guess I was wrong. Nov 11, 2015 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.