Java Security

Hi

The tutorials mentioning GSS-API create a secure context and once established start passing tokens between each other based on a proprietary protocol (a knock-knock joke if I remember...).

Can this protocol be HTTP? I want to bolt the GSS mechanism onto an existing web application so all my JSPs, Servlets etc etc go through this secure channel once authentication has taken place.

Thanks!