[FIXED] Webserver handling SSL connection for Tomcat Servlet

Issue

I understand the Tomcat documentation as following: If I have a webpage like https://mywebpage.com and I have a servlet accessible as https://mywebpage.com/pathToServlet/MyServlet, then the Webserver already fully handles the SSL connection?

Does it mean I don't even need to change the servlet code, and it would be sufficient to use

@WebServlet(urlPatterns = {"/MyServlet"})
public class MyServlet extends HttpServlet { ... }

Is this correct or do I misunderstand the concept?

Solution

You are correct. Tomcat will handle the SSL details for you.

Your servlet will just receive the request, no matter if it arrived over HTTP or HTTPS, because the URL patterns you declare in your servlet are on the server, no matter on what domain or protocol the server is exposed with. For example, all requests sent to these URLs will reach your servlet, assuming your Tomcat listens on port 80 and 443 on these domains:

http://mywebpage.com/pathToServlet/MyServlet
https://mywebpage.com/pathToServlet/MyServlet
http://someotherdomain.com/pathToServlet/MyServlet
https://someotherdomain.com/pathToServlet/MyServlet

When your servlet receives the request, there will be some details that allow you as a programmer to figure out on what type of connection the request arrived on, like for example ServletRequest.isSecure() method, and some other SSL attributes (see section 3.9 in this spec, or whatever version you have).

Obviously, when running Tomcat behind another web server, such as Apache, Nginx, IIS, etc, it's possible that SSL is handled by Apache, Nginx, IIS, and not by Tomcat. In that case the web server needs to provide Tomcat with extra information when passing the request to it, to say if the request arrived on HTTPS or HTTP, or add any extra details on the request about the client call.

Answered By - Bogdan