Using SSL with Soap on java, No servlet

Question

I was following a fairly useful online tutorial to create a soap server that used mysql to call a stored procedure. This worked quite well and I got code that would respond correctly using a program like SoapUI. The code is as below:

@WebService
public class test {

@WebMethod
public String login(String username, String password) throws SQLException {
    String url = "jdbc:mysql://localhost:3306/test";
    String DBusername = "test";
    String DBpassword = "test";
    Connection con = DriverManager.getConnection(url, DBusername, DBpassword);

    Statement stmt = null;
    String query = " CALL authorize_user('" + username + "','" + password + "')";

    try {
        stmt = con.createStatement();
        ResultSet rs = stmt.executeQuery(query);
        while (rs.next()) {
            String login = rs.getString("au_result");

            if (login != null)
                return login;
            else {
                return "Login Failed";
            }
        }
    } catch (SQLException e) {
        System.out.println("Error: " + e);
    } finally {
        if (stmt != null) {
            stmt.close();
        }
    }
    return "Login Failed";
}

public static void main(String[] args) {
    test test = new test();
    @SuppressWarnings("unused")
    Endpoint endpoint = Endpoint.publish("http://localhost/testing", test);
}

}

So this works when you put in a username and password that is in the DB it will return a positive result. This is only test code, because of the possibility of injection into the code the way its set up now, but that will be changed shortly.

However I am attempting to find a way to use SSL for this server, and the only information I'm able to find is how to use SSL when using a wrapper program or some servlet wrapper to create the soap server. We don't want to go this way at this point, unless we can find a very very good reason to waste the time learning the new code. How would I go about using an SSL connection for this code without using any third party code? We already have a cert from a reputable company that is running on our server for our regular website.

Answer 1

Did you consider non programming solution?

Just put Apache with SSL as reverse proxy before your web server.

• You don't need to write a line of code (less possibilities for security bugs)
• You get SSL
• You get balancer (if you need it)
• You get caching (if you need it) and so on