code: public static boolean needsToBeSecure(ServletContext context, ServletRequest request,
                                            String uri, boolean stripContextPath)
      {
          // Get the web-app relative path for security check
          String secureCheck = uri;
          if (stripContextPath) {
              String contextPath = ((HttpServletRequest) request).getContextPath();
              if (secureCheck.startsWith(contextPath)) {
                  secureCheck = secureCheck.substring(contextPath.length());
              }
          }
  
          boolean secure = false;
          if (secureCheck.indexOf('?') > -1) {
              secureCheck = secureCheck.substring(0, secureCheck.indexOf('?'));
          }
  
          SecurityProtocol sp = getSecurityProtocol(secureCheck, context, (HttpServletRequest) request);
          if (sp.equals(SecurityProtocol.UNSPECIFIED)) {
              secure = request.isSecure();
          }
          else {
              secure = sp.equals(SecurityProtocol.SECURE);
          }
  
          return secure;
      }
docs: Tell whether a given URI should be written to be secure.
  @param context          the current ServletContext.
  @param request          the current HttpServletRequest.
  @param uri              the URI to check.
  @param stripContextPath if <code>true</code>, strip the webapp context path from the URI before
  processing it.
  @return <code>true</code> when:
  <ul>
  <li>the given URI is configured in the deployment descriptor to be secure (according to
  {@link SecurityProtocol}), or
  <li>the given URI is not configured in the deployment descriptor, and the current request
  is secure ({@link HttpServletRequest#isSecure} returns
  <code>true</code>).
  </ul>
  <code>false</code> when:
  <ul>
  <li>the given URI is configured explicitly in the deployment descriptor to be unsecure
  (according to {@link SecurityProtocol}), or
  <li>the given URI is not configured in the deployment descriptor, and the current request
  is unsecure ({@link HttpServletRequest#isSecure} returns
  <code>false</code>).
  </ul>