title: Protecting Jersey web service with SSL
body: <p>I have pretty simple web-service, which runs on the Embedded Glassfish server:</p>
  
  <pre><code>@Stateless
  @Path("/id")
  @Produces(MediaType.TEXT_HTML)
  public class SimpleFacadeBean {
  
      @GET
      public String sayHello(@Context HttpServletRequest request, @Context HttpServletResponse response) {
          return "Hello world!";
      }
  }
  </code></pre>
  
  <p>And corresponding class, that set root-element for all web-service calls:</p>
  
  <pre><code>@ApplicationPath("root")
  public class ApplicationConfig extends Application {
  }
  </code></pre>
  
  <p>Everything works fine, but I want to protect this GET method through SSL. 
  I have read such manuals as: <a href="http://www.coderanch.com/t/466202/Web-Services/java/SSL-Web-Services-Glassfish" rel="nofollow">this</a>, and <a href="http://www.java-tips.org/java-ee-tips/java-api-for-xml-web-services/using-jax-ws-based-web-services-wit.html" rel="nofollow">this</a>. I am not interested in configuring Glassfish part of SSL connection (I know how to do it), I just want not to see my GET method in <em>localhost:8080/root/application.wadl</em> link (this will mean that my web-service is connected to 8181 secure glassfish port, not to default unsecure 8080 port). 
  For this purpose I wrote web.xml descriptor and put it in webapp/WEB-INF directory. The most interesting part of it looks like:</p>
  
  <pre><code>&lt;security-constraint&gt;   
      &lt;display-name&gt;SecurityConstraint&lt;/display-name&gt;   
      &lt;web-resource-collection&gt;   
          &lt;web-resource-name&gt;Secure Area&lt;/web-resource-name&gt;   
          &lt;url-pattern&gt;/root/id&lt;/url-pattern&gt;               
          &lt;http-method&gt;GET&lt;/http-method&gt;   
      &lt;/web-resource-collection&gt;             
      &lt;user-data-constraint&gt;   
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;   
      &lt;/user-data-constraint&gt;   
  &lt;/security-constraint&gt;   
  </code></pre>
  
  <p>But after executing I saw (in <em>application.wadl</em>) again my web-service URL connected to unsecured port (8080 instead of 8181). I have tried a lot of other ways, trying to make my code work correctly. I was not successful at all.
  I package this web-services into .war. After that this .war goes to .ear. Any ideas why I am not successful in NOT seeing my "secure" web-service in <em>application.wadl</em>? </p>