Alpha Software Mobile Development Tools:   Alpha Anywhere    |   Alpha TransForm subscribe to our YouTube Channel  Follow Us on LinkedIn  Follow Us on Twitter  Follow Us on Facebook

Announcement

Collapse

The Alpha Software Forum Participation Guidelines

The Alpha Software Forum is a free forum created for Alpha Software Developer Community to ask for help, exchange ideas, and share solutions. Alpha Software strives to create an environment where all members of the community can feel safe to participate. In order to ensure the Alpha Software Forum is a place where all feel welcome, forum participants are expected to behave as follows:
  • Be professional in your conduct
  • Be kind to others
  • Be constructive when giving feedback
  • Be open to new ideas and suggestions
  • Stay on topic


Be sure all comments and threads you post are respectful. Posts that contain any of the following content will be considered a violation of your agreement as a member of the Alpha Software Forum Community and will be moderated:
  • Spam.
  • Vulgar language.
  • Quotes from private conversations without permission, including pricing and other sales related discussions.
  • Personal attacks, insults, or subtle put-downs.
  • Harassment, bullying, threatening, mocking, shaming, or deriding anyone.
  • Sexist, racist, homophobic, transphobic, ableist, or otherwise discriminatory jokes and language.
  • Sexually explicit or violent material, links, or language.
  • Pirated, hacked, or copyright-infringing material.
  • Encouraging of others to engage in the above behaviors.


If a thread or post is found to contain any of the content outlined above, a moderator may choose to take one of the following actions:
  • Remove the Post or Thread - the content is removed from the forum.
  • Place the User in Moderation - all posts and new threads must be approved by a moderator before they are posted.
  • Temporarily Ban the User - user is banned from forum for a period of time.
  • Permanently Ban the User - user is permanently banned from the forum.


Moderators may also rename posts and threads if they are too generic or do not property reflect the content.

Moderators may move threads if they have been posted in the incorrect forum.

Threads/Posts questioning specific moderator decisions or actions (such as "why was a user banned?") are not allowed and will be removed.

The owners of Alpha Software Corporation (Forum Owner) reserve the right to remove, edit, move, or close any thread for any reason; or ban any forum member without notice, reason, or explanation.

Community members are encouraged to click the "Report Post" icon in the lower left of a given post if they feel the post is in violation of the rules. This will alert the Moderators to take a look.

Alpha Software Corporation may amend the guidelines from time to time and may also vary the procedures it sets out where appropriate in a particular case. Your agreement to comply with the guidelines will be deemed agreement to any changes to it.



Bonus TIPS for Successful Posting

Try a Search First
It is highly recommended that a Search be done on your topic before posting, as many questions have been answered in prior posts. As with any search engine, the shorter the search term, the more "hits" will be returned, but the more specific the search term is, the greater the relevance of those "hits". Searching for "table" might well return every message on the board while "tablesum" would greatly restrict the number of messages returned.

When you do post
First, make sure you are posting your question in the correct forum. For example, if you post an issue regarding Desktop applications on the Mobile & Browser Applications board , not only will your question not be seen by the appropriate audience, it may also be removed or relocated.

The more detail you provide about your problem or question, the more likely someone is to understand your request and be able to help. A sample database with a minimum of records (and its support files, zipped together) will make it much easier to diagnose issues with your application. Screen shots of error messages are especially helpful.

When explaining how to reproduce your problem, please be as detailed as possible. Describe every step, click-by-click and keypress-by-keypress. Otherwise when others try to duplicate your problem, they may do something slightly different and end up with different results.

A note about attachments
You may only attach one file to each message. Attachment file size is limited to 2MB. If you need to include several files, you may do so by zipping them into a single archive.

If you forgot to attach your files to your post, please do NOT create a new thread. Instead, reply to your original message and attach the file there.

When attaching screen shots, it is best to attach an image file (.BMP, .JPG, .GIF, .PNG, etc.) or a zip file of several images, as opposed to a Word document containing the screen shots. Because Word documents are prone to viruses, many message board users will not open your Word file, therefore limiting their ability to help you.

Similarly, if you are uploading a zipped archive, you should simply create a .ZIP file and not a self-extracting .EXE as many users will not run your EXE file.
See more
See less

SSL and non-SSL on a high traffic website

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    SSL and non-SSL on a high traffic website

    I have an Alpha app that already has 15 instances of Alpha WAS to support its heavy traffic. I need to use SSL for the payment pages because it includes credit card information. So my site needs to be part non-SSL, and part SSL. There are simple instructions on how to do this, where you define one or more Alpha WAS instances with the SSL option. But I already have to have 15 instances to support my traffic, and a load balancer to balance the load over those 15 instances. I can't 'cheat' and have 7 non-SSL and 8 SSL because I won't know where the users are concentrated - on the payment pages or elsewhere. I have to assume full traffic on both SSL and non-SSL.

    So, assuming I need all of those instances to support traffic, it seems I also need the same number of instances to support the SSL traffic. So 15 non-SSL and 15 SSL or 30 instances. Does anyone know the answer to any of the questions below:
    • Will all of the session variables be carried over from the non-SSL instance to the SSL instance?
    • Will the load balancer even allow this to happen?
    • What else isn't going to make me happy?
    Steve Wood
    See my profile on IADN


    #2
    Re: SSL and non-SSL on a high traffic website

    Steve is there any reason not to make all ssl?
    Chad Brown

    Comment


      #3
      Re: SSL and non-SSL on a high traffic website

      Yes, all SSL is an option. I guess my answer is because I don't want to just because I have high volume. Amazon is all non-SSL until you get to the checkout page.
      Steve Wood
      See my profile on IADN

      Comment


        #4
        Re: SSL and non-SSL on a high traffic website

        Steve,

        In my experience, the SSL is actually a different domain, so none of the session variables will carry over. You'll need to send a token in the url or use an http post to indicate which order to process, then use that to go to the tables to get the order info.

        However, the load question is more what activity each person will have. The non-SSL side will have the casual lookers, the robots, the browsers and the ordering users going through a number of pages or lookups, while the payments page could be as little as a single grid. As you know, it's not the number of connections, but how busy the connections are.

        So, I think you'll find the SSL needs less than the non-SSL needs. No idea what the ratio would be, but a guess would be about 1 SSL for every 4 or 5 non-SSL.

        Pat
        Pat Bremkamp
        MindKicks Consulting

        Comment


          #5
          Re: SSL and non-SSL on a high traffic website

          I will have to see what other websites do when they shift from HTTP to HTTPS for checkout. I can ensure everything required by the checkout process is stored to the database and then pass the CartID to the checkout page. I happen to have more than normal number of session vars that need to be available on that checkout page, so need to figure out what to do with those, again probably ensuring the values are in the database and can be recreated using the CartID.
          Steve Wood
          See my profile on IADN

          Comment


            #6
            Re: SSL and non-SSL on a high traffic website

            Why not make a table and store all the variables you need?
            Then write post to another page with the tables primary key id.

            Use the other page (on a seperate domain) to connect to database1 and load the details from that table.

            As far as im concerned - most part SSL sites are 2 seperate domains. And basically youd set your non SSL up in one farm and your SSL site up in another farm. You could load balance them seperately and they would be completely independant of each other.

            Theoretically that should work - although ive never worked with farms or part SSL sites, but I usually notice the url is a subdomain

            e.g mysite.com checkout.mysite.com



            Also - you could store something like this (i added this because you said you had an unusual amount of variables so usually you use an EAV structure (entity-attribute-value))

            CartVariables
            cartid (foreign key to cart, cascade delete, cascade update)
            varname
            varvalue
            protected (tinyint(1))

            1 ulink 01d0ad0210kd201dk 1
            1 myvar var1value 1
            1 myvar2 var2value 0


            Then youd be able to load your cart variables from your new domain and set them to local variables for processing.

            The protected flag is just there in case for some reason you need to repopulate the session in the checkout page (so youd probably want to know what is protected or not - but session variables should always be protected imo), but for the most part you could use local variables. You may want to set the cart id, ulink and something else in session.

            Page 1 (checkout)
            -Load from cart using cartid
            -Load cart variables and assign to local scope variables (either to a property array or use some dynamic variable creation)
            -Show a confirmation
            -Redirect to checkout processor using the cartid in session

            Processor (page 2)
            -Load the cart again
            -Process payment etc etc

            Receipt (page 3)
            -Load the cart again
            -Show a summary of items in a printable receipt
            __
            Last edited by aburningflame; 12-02-2010, 08:22 AM.
            Scott Moniz - Computer Programmer/Analyst
            REA Inc.
            http://reainc.net
            (416)-533-3777
            [email protected]

            REA INC offers consulting services, programming services, systems design, database design, third party payment gateway integration (CHASE, PAYPAL, AUTHORIZE.NET) and developer support.
            If you need custom code, or 1-to-1 mentoring in any facet of your database/web application design,
            contact us to discuss options.

            Comment


              #7
              Re: SSL and non-SSL on a high traffic website

              Steve

              The problem is that Alpha server can only answer to one port I have brought this to Richard's attention All other web servers are capable of dual answering that is how they do it The only way to do this in Alpha that I have figured out is to have two alpha servers running one on port 443 and the other on port 80 and pointing to the same webroot folder just haven't figured out how to SHARE the cookie / session Not sure if a page redirect would carry the session id with it.

              Greg
              Last edited by glbaird; 12-02-2010, 01:57 PM.

              Comment


                #8
                Re: SSL and non-SSL on a high traffic website

                Steve,

                Would you mind sharing how many hits you are getting at this site or how many users it is serving concurrently? I have just finished my first large application with Alpha Five and am thinking about a SAAS application with Alpha Five. My biggest fear is the server itself and how many instances would be required if the concept took off. While Alpha helps us from a developer perspective the pages developed using grids are fairly "heavy" in terms of page size and thus limits server throughput.

                Thanks,

                Rod

                Comment


                  #9
                  Re: SSL and non-SSL on a high traffic website

                  Steve,

                  From a session perspective, I am not sure how the server treats sessions from a SSL vs non-SSL perspective but if the sessions were stored as cookies then this should not be an issue.

                  Rod

                  Comment


                    #10
                    Re: SSL and non-SSL on a high traffic website

                    how many instances would be required if the concept took off
                    Rod, I'm not going to discuss that on the forum, but please call or email me if you want to know the result of my testing in this area.
                    Steve Wood
                    See my profile on IADN

                    Comment


                      #11
                      Re: SSL and non-SSL on a high traffic website

                      Originally posted by RodMc View Post
                      Steve,

                      From a session perspective, I am not sure how the server treats sessions from a SSL vs non-SSL perspective but if the sessions were stored as cookies then this should not be an issue.

                      Rod
                      The sessions will NOT be shared between non-SSL and SSL.

                      Lenny Forziati
                      Vice President, Internet Products and Technical Services
                      Alpha Software Corporation

                      Comment


                        #12
                        Re: SSL and non-SSL on a high traffic website

                        Originally posted by Lenny Forziati View Post
                        The sessions will NOT be shared between non-SSL and SSL.
                        I think these subjects should be easier to do .
                        Define AFAS as an [session] broker manager capable of running serveral instances without concern of ssl yes or no.
                        Thats results to a new kernel for AFAS but a opening to other great opertunities.

                        my2p

                        Comment


                          #13
                          Re: SSL and non-SSL on a high traffic website

                          Steve,

                          I know you mentioned Amazon going back and forth but many sites are now heading to full security all the time. Look at the announcement from Hotmail who now enable you to use https throughout the site.

                          3 weeks ago a little Firefox extension was released called FireSheep.

                          http://codebutler.com/

                          This thing has upset the apple cart as far as security on many sites are concerned. It is now very easy to hijack wireless connections and take control of the website they are on eg) Facebook, Twitter, etc.

                          A quick google on firesheep should keep you reading for quite a while and perhaps change your mind about not just leaving a site secure.

                          Comment

                          Working...
                          X