Secure JSP page(s)

[rottweiler]

Hey, I'm making a jsp page to let people change their personal information via the web.
This is a favor for a group that is pretty important, and I want to make sure the site will be secure.
They don't know a lot about web pages, and although I've been doing html and jsp for a while, I never really had to worry about security before.
I know you should probably use SSL, and I assume this depends on who is hosting your web page, right?
Their host is myCP (mycp.superb.net).
I don't know much about them, but it it says a sub account is 'iis PROTECT website protection'.
Does anyone know about this?
Or more importantly what I have to do to use it correctly.
Both to turn it on, and what I have to do in my jsp code so everything will be safe.
Can I send data normally between pages using form post and the request variable?
Also to handle logging in with a username and password, will I have to use anything special.
I did make a registration page before for my job which went on a secure site, and I was told I didn't need to do anything special.
So if we turn on SSL, can I code like I normally would, obviously without using form get for anything I want kept safe.

Also, is there anything else I should know?

Thanks,
Ted

 

[KingKaeru]

Hey, I'm making a jsp page to let people change their personal information via the web.
This is a favor for a group that is pretty important, and I want to make sure the site will be secure.
They don't know a lot about web pages, and although I've been doing html and jsp for a while, I never really had to worry about security before.
I know you should probably use SSL, and I assume this depends on who is hosting your web page, right?
Their host is myCP (mycp.superb.net).
I don't know much about them, but it it says a sub account is 'iis PROTECT website protection'.
Does anyone know about this?
Or more importantly what I have to do to use it correctly.
Both to turn it on, and what I have to do in my jsp code so everything will be safe.
Can I send data normally between pages using form post and the request variable?
Also to handle logging in with a username and password, will I have to use anything special.
I did make a registration page before for my job which went on a secure site, and I was told I didn't need to do anything special.
So if we turn on SSL, can I code like I normally would, obviously without using form get for anything I want kept safe.

Also, is there anything else I should know?

Thanks,
Ted

Your SSL connection is transparent to your webapp. Ask your host about setting up an SSL protected server. You'll need a certificate (about $150 depending). Other than that, all you have to do is access it via https:// (port 443) rather than http:// (80). Take note that an SSL encrypted connection will help protect against people possibly sniffing the data going between the client and the server. It by no means protects against XSS vulnerabilities.

--KK