如果你的webapp需要只能够进行https方式访问,那么在webapp的web.xml里加上:
 <security-constraint>
  <web-resource-collection>
   <web-resource-name>must https</web-resource-name>
   <url-pattern>/login/*</url-pattern> <!--限制/login/*必须以https方式来访问-->
  </web-resource-collection>
  <user-data-constraint>
   <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
 </security-constraint>
参考:http://jakarta.apache.org/tomcat/faq/security.html#https
http://marc.theaimsgroup.com/?l=tomcat-user&m=104951559722619&w=2