implementing remember password in tomcat server jdbcrealm

[onewebclick]

need to implement "remember my password " simiar to one in google or
any other website where the site would allow to let the user log in
without asking for credentials. iam using tomcat 5.0.18, JDBCRealm.


i got some idea that i might have to store the userid/password in the
cookie probaly encrypted (not sure whether encryotion needed or not ).


The thing is iam not sure when is should set the cookie , beucase once

the user gets authenticated successfully the next page that its
forwarded to is not getting the paramters of j_username and j_password

it seems like the j_security_check seems to clear the parameters after
the request is made to it.


i can get the j_username using request.getRemoteUSer() but not sure how

to get the password once authenticated ?


also i have a signin page ; when i use response.sendRedirect() it seems

to work but if i use RequestDispatcher to forward it doesn;t seems to .



<%
Cookie[] cookies=request.getCookies();
String jusername=null;
String jpassword=null;
for (int i=0;i<cookies.length;i++) {
if (cookies.getName().equals("­j_username"))
jusername=cookies.getValue(­);
if (cookies.getName().equals("­j_password"))
jpassword=cookies.getValue(­);
}
if ((jusername !=null) && (jpassword != null)) {


//this doesn't work
RequestDispatcher
r=pageContext.getServletContex­t().getRequestDispatcher("/web­clickswebapp/j_security_check?­j_username="+jusername+"&j_pas­sword="+jpassword");

r.forward(request,response);


//this works


response.sendRedirect("/webcli­ckswebapp/j_security_check?j_u­sername="+jusername+"&j_passwo­rd="+jpassword);//

works
}


any help or any easyway to implement , let me know will be appreciated.



i googled a lot about htis topic everytime i hit a dead end without
gettting a clear idea on how to do it.


Reply

 

[Eric Sosman]

need to implement "remember my password " simiar to one in google or
any other website where the site would allow to let the user log in
without asking for credentials. iam using tomcat 5.0.18, JDBCRealm.

<rant>

"Remember my password" is an abomination. Your site
will be better if you do *not* have it. If you were a
locksmith, would you install a nice little hook for the
latchkey just outside the customer's front door?

If you insist on implementing this vile idea, at least
have the decency to use a better description: "Expose my
password" or "Steal my password" would be more honest.

Col. Bloodnok: Are you ready to take the regimental oath?

Neddy & Eckles: We are.

C.B.: Very well, then. Open your wallets and repeat after
me: "Help yourself."

N&E: "Help yourself."

C.B.: Thank you.

</rant>