Struts and Form-Based Authentication

[Dom]

Hi,

I am using Form-Based Authentication with Struts and Tomcat.

When I log in I want to first process the form through struts and then
force the container security framework to authenticate the user
through a sendRedirect. The reason why I want to do this is because if
the user checks the remember me option I can then set up a cookie to
store their typed in username and password.

My login.jsp is:
<html:form action="login.do">
Username:<html:text name="loginForm" property="j_username"/><br>
Password:<html:text name="loginForm" property="j_password"/><br>
<html:submit property="whichAction"
title="Submit">Submit</html:submit>
</html:form>

My code that processes this form in LoginAction:
LoginForm loginForm = ((LoginForm)form);
String auth = "j_security_check?j_username=" +
loginForm.getJ_username() + "&j_password=" +
loginForm.getJ_password();
response.sendRedirect(auth);


The sendRedirect does not work. How do I make struts understand that I
want it to process the container "j_security_check"?

Can someone help please?

Dom

 

[Bryce]

Hi,

I am using Form-Based Authentication with Struts and Tomcat.

When I log in I want to first process the form through struts and then
force the container security framework to authenticate the user
through a sendRedirect. The reason why I want to do this is because if
the user checks the remember me option I can then set up a cookie to
store their typed in username and password.

My login.jsp is:
<html:form action="login.do">
Username:<html:text name="loginForm" property="j_username"/><br>
Password:<html:text name="loginForm" property="j_password"/><br>
<html:submit property="whichAction"
title="Submit">Submit</html:submit>
</html:form>

My code that processes this form in LoginAction:
LoginForm loginForm = ((LoginForm)form);
String auth = "j_security_check?j_username=" +
loginForm.getJ_username() + "&j_password=" +
loginForm.getJ_password();
response.sendRedirect(auth);


The sendRedirect does not work. How do I make struts understand that I
want it to process the container "j_security_check"?

Can someone help please?

Don't know off the top of my head, but you could take a look at
AppFuse. They have this functionality built in.

https://appfuse.dev.java.net/

 

[NOBODY]

First, why don't you just use javascript to write the cookie upon
form.submit()?
You are overkilling it...

Second, why don't you just use longer httpsessions if you intend to auto
login? JSESSIONID can last way more than 60 minutes.

Third, modern browsers do have form completion. Let the user decide if he
wants or not the password to be store at all. It is not secure otherwise.

 

[Dom]

First, why don't you just use javascript to write the cookie upon

form.submit()?
You are overkilling it...

Accessibility standards mean javascript cannot be used.

Second, why don't you just use longer httpsessions if you intend to auto
login? JSESSIONID can last way more than 60 minutes.

Longer httpsessions is memory expensive.

Third, modern browsers do have form completion. Let the user decide if he
wants or not the password to be store at all. It is not secure otherwise.

Suppose this might be a good option.


However, I'd still like to know why my sendredirect didn't work.....so
I put it back out there.....anyone, anyone, anyone?

 

[NOBODY]

Accessibility standards mean javascript cannot be used.

which standards? Have you tried to navigate without javascript lately?
Whatever. It's your app...

But again, storing password in non-encrypted ways in a cookie is unsafe.

Longer httpsessions is memory expensive.

Not if you enable a httpsession manager that uses persisance, ex: a DB.
Look at tomcat doc... You'll see. Sessions could last years.

Suppose this might be a good option.


However, I'd still like to know why my sendredirect didn't work.....so

j_security_check isn't just any page:
it deal with the referrer so you can get redirected to the originaly
requested page. I don't think tomcat will let you trap that service.

If you can't do it in plain servlet api (best guess is a servletfilter)
then you won't be able to do in in struts either.

I would forget strust, try with a servletfilter, grab the name/pwd, set
cookie in response and doFilterChain().