Encrypt HTTP post parameters from JSP to servlet

Question

I have a login JSP which takes username / password from the user in text boxes and on submit it forwards the username/password parameters to Login Servlet using POST method.

Now I am using Paros Proxy in between (as Man-In-The-Middle attack) to trap the parameters. The parameters received from JSP are captured in Paros as plain text.

Is there any specific method provided by Java standard API which we can use to encrypt these parameters such a way that:

Even if the parameters are captured by Paros Proxy, it may not be able to display in plain text.
Servlet do not have to decrypt it.

How can I achieve this?

You certainly don't want to just "encode" them. You want to "encrypt" them, which is an entirely different thing. Encoded information can be decoded without some security key (e.g. URL encoding, character encoding, HTML encoding, etc). Encrypted information can't be decrypted without some security key. I've fixed the wrong terminology in your question. — BalusC
– BalusC, Commented Sep 5, 2012 at 11:46
@BalusC Thanks for removing the boldness, it was little too much emphasis for my taste! — f_puras
– f_puras, Commented Sep 5, 2012 at 11:54

f_puras · Accepted Answer · 2012-09-05 11:00:18Z

3

Use SSL to protect your data from being sniffable. If you require that no decoding (probably meaning decrypting) is to be performed on the server side, I cannot think of any other way.

answered Sep 5, 2012 at 11:00

f_puras

2,5134 gold badges37 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Hushen Savani Over a year ago

Thanks for responding. I tried using SSL with my tomcat using this link, but it is showing certificate error (may be bcoz no cert from CA). But still it runs on HTTPS with certificate error.. but surprisingly Paros can look into those parameters as well in plaintext.. no luck with SSL either :-(

f_puras Over a year ago

Why not try and use Apache HTTPD for SSL handling? Connecting it to servlet containers like Tomcat is quite easy, and there is plenty of documentation for each and every configuration aspect.

BalusC Over a year ago

SSL is the answer to your question. You need to concentrate on solving your concrete certificate problem. Feel free to ask a new question about that step (on serverfault).

Collectives™ on Stack Overflow

Encrypt HTTP post parameters from JSP to servlet

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related