Redirect to secured URL (HTTPS) on the server-side

My goal is to have a HTTPS secured login service (GWT-RPC) and the rest is non-HTTPS. I want to have a non开发者_JAVA百科-HTTPS authentication service that checks the session if the user is logged in and successfully authenticated. If this fails, the service shall redired the client to the HTTPS secured login. My idea is to do authentication in every service (except the login service and the authentication service itself).

All services are XSRF protected (except the login service).

1) Does it make sense to have every service authenticated? 2) Is there a way to do that in the service on the server-side (until now I have only found ways to do that on the client)?

1. In my opinion it makes sense. It's important to not leave any security holes open.

2. Within your RemoteServiceServlet, you can do the following to redirect your request to HTTPS:

   getThreadLocalResponse().sendRedirect("https://yourUrl");