B/S数据传输加密

Question

是不是保证在传输过程中不被切听啊！
那就用ssl（java安全套节字）好了！只要在web server上设置一下就好了！

Answer 1

The user-data-constraint element is used to indicate how data communicated
between the client and container should be protected
<!ELEMENT user-data-constraint (description?, transport-guarantee)>
The transport-guarantee element specifies that the communication between
client and server should be NONE, INTEGRAL, or CONFIDENTIAL.
NONE means that the application does not require any transport guarantees.
A value of INTEGRAL means that the application requires that the data sent
between the client and server be sent in such a way that it can’t be changed in
transit.
CONFIDENTIAL means that the application requires that the data be transmitted
in a fashion that prevents other entities from observing the contents of the
transmission.
In most cases, the presence of the INTEGRAL or CONFIDENTIAL flag will
indicate that the use of SSL is required.
<!ELEMENT transport-guarantee (#PCDATA)>
Please send your comments to: [email protected]
28
Example
<web-app>
<display-name>A Secure Application</display-name>
<security-role>
<role-name>manager</role-name>
</security-role>
<servlet>
<servlet-name>catalog</servlet-name>
<servlet-class>com.mycorp.CatalogServlet</servlet-class>
<init-param>
<param-name>catalog</param-name>
<param-value>Spring</param-value>
</init-param>
<security-role-ref>
<role-name>MGR</role-name>
<!-- role name used in code -->
<role-link>manager</role-link>
</security-role-ref>
</servlet>
<servlet-mapping>
<servlet-name>catalog</servlet-name>
<url-pattern>/catalog/*</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>SalesInfo</web-resource-name>
<url-pattern>/salesinfo/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>manager</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
</web-app>

Answer 2

The user-data-constraint element is used to indicate how data communicated
between the client and container should be protected
<!ELEMENT user-data-constraint (description?, transport-guarantee)>
The transport-guarantee element specifies that the communication between
client and server should be NONE, INTEGRAL, or CONFIDENTIAL.
NONE means that the application does not require any transport guarantees.
A value of INTEGRAL means that the application requires that the data sent
between the client and server be sent in such a way that it can’t be changed in
transit.
CONFIDENTIAL means that the application requires that the data be transmitted
in a fashion that prevents other entities from observing the contents of the
transmission.
In most cases, the presence of the INTEGRAL or CONFIDENTIAL flag will
indicate that the use of SSL is required.
<!ELEMENT transport-guarantee (#PCDATA)>
Please send your comments to: [email protected]
28
Example
<web-app>
<display-name>A Secure Application</display-name>
<security-role>
<role-name>manager</role-name>
</security-role>
<servlet>
<servlet-name>catalog</servlet-name>
<servlet-class>com.mycorp.CatalogServlet</servlet-class>
<init-param>
<param-name>catalog</param-name>
<param-value>Spring</param-value>
</init-param>
<security-role-ref>
<role-name>MGR</role-name>
<!-- role name used in code -->
<role-link>manager</role-link>
</security-role-ref>
</servlet>
<servlet-mapping>
<servlet-name>catalog</servlet-name>
<url-pattern>/catalog/*</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>SalesInfo</web-resource-name>
<url-pattern>/salesinfo/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>manager</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
</web-app>

Answer 3

很容易，采用SSL连接，基本上所有的应用服务器都支持SSL，这是加密传输的协议，工作在TCP层上，基本不用做什么额外的开发，只要配置好了就可以了，而且浏览器也都支持。楼上所说的只是进入页面可以采用应用服务器进行管理，但是网络上所传输的还是明文数据，这就无法满足楼主的要求。

Answer 4

我用websphere & IBM http ,看帮助文档说用ldap,不知是不是这样？
哪有关于websphere配置ssl方面的资料？
传输加密是配置http还是websphere?
我是一个菜鸟，
麻烦大家一下，
马上就给分。