java - Spring Security 3.1.0 - Cannot switch from HTTPS to HTTP -

java - Spring Security 3.1.0 - Cannot switch from HTTPS to HTTP -

i new spring security, made little webapp in order seek , find configuration useful project working on. forcing login page accessed via https, , need switch http after logging in. in other words:

login page: https only other pages: http only

i tried several ways cannot create work said above. read spring security faq , see there no "natural" way of doing want, have been asked so, hence need workaround cannot find myself.

i using spring security 3.1.0. web container tomcat 6.0.33.

this spring security configuration:

class="lang-xml prettyprint-override"><?xml version="1.0" encoding="utf-8"?> <beans xmlns:sec="http://www.springframework.org/schema/security" xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <sec:http auto-config="true" use-expressions="true"> <sec:intercept-url pattern="/log*.htm" access="anonymous" requires-channel="https" /> <sec:intercept-url pattern="/admin/**" access="hasrole('admin')" requires-channel="http" /> <sec:intercept-url pattern="/**" requires-channel="http" access="hasrole('authenticated')" /> <sec:form-login login-page="/login.htm" default-target-url="/index.htm" authentication-failure-url="/login.htm?error=true" always-use-default-target="true" /> <sec:logout logout-url="/logout.htm" delete-cookies="jsessionid" invalidate-session="true" /> <sec:anonymous/> <sec:remember-me use-secure-cookie="true" /> </sec:http> <sec:authentication-manager> <sec:authentication-provider> <sec:user-service> <sec:user name="johnny" password="johnny" authorities="authenticated, admin" /> <sec:user name="charlie" password="charlie" authorities="authenticated" /> </sec:user-service> </sec:authentication-provider> </sec:authentication-manager> </beans>

any help appreciated. in advance!

the workaround found problem disabling spring security's default session fixation protection. had add together "session-management" element xml configuration first described.

<sec:http auto-config="true"> <!-- ... --> <sec:session-management session-fixation-protection="none"/> <!-- ... --> </sec:http>

in add-on this, url have provide "application url" not login url home page url, e.g. not http://myapp/login.htm http://myapp/index.htm. doing so, if user logged in or has remember-me cookie, able come in without problem , browser keeps using http protocol. if not, user redirected login page using https, , after successful login browser switches http correctly. please take account, because if write (or click) login url directly, https maintained time.

java https spring-security