From tomcat-user-return-85601-apmail-jakarta-tomcat-user-archive=jakarta.apache.org@jakarta.apache.org Wed Dec 03 23:53:48 2003
Return-Path: <tomcat-user-return-85601-apmail-jakarta-tomcat-user-archive=jakarta.apache.org@jakarta.apache.org>
Delivered-To: apmail-jakarta-tomcat-user-archive@www.apache.org
Received: (qmail 16677 invoked from network); 3 Dec 2003 23:53:48 -0000
Received: from daedalus.apache.org (HELO mail.apache.org) (208.185.179.12)
  by minotaur-2.apache.org with SMTP; 3 Dec 2003 23:53:48 -0000
Received: (qmail 89276 invoked by uid 500); 3 Dec 2003 23:52:57 -0000
Delivered-To: apmail-jakarta-tomcat-user-archive@jakarta.apache.org
Received: (qmail 89252 invoked by uid 500); 3 Dec 2003 23:52:57 -0000
Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
List-Unsubscribe: <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
List-Subscribe: <mailto:tomcat-user-subscribe@jakarta.apache.org>
List-Help: <mailto:tomcat-user-help@jakarta.apache.org>
List-Post: <mailto:tomcat-user@jakarta.apache.org>
List-Id: "Tomcat Users List" <tomcat-user.jakarta.apache.org>
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Delivered-To: mailing list tomcat-user@jakarta.apache.org
Received: (qmail 89239 invoked from network); 3 Dec 2003 23:52:56 -0000
Received: from unknown (HELO sccrmhc11.comcast.net) (204.127.202.55)
  by daedalus.apache.org with SMTP; 3 Dec 2003 23:52:56 -0000
Received: from [192.168.0.198] (c-67-162-133-54.client.comcast.net[67.162.133.54])
          by comcast.net (sccrmhc11) with SMTP
          id <2003120323530201100i4rhke>; Wed, 3 Dec 2003 23:53:03 +0000
In-Reply-To: <3FCE6FDC.4040304@cyberspaceroad.com>
References: <D11FD8AE7B15D64285EA3A41DFCCFFB19B2713@HORIZON2.horizon-asset.co.uk> <A40A3E5E-25CE-11D8-9774-000A958E58CC@raibledesigns.com> <3FCE6FDC.4040304@cybers
paceroad.com>
Mime-Version: 1.0 (Apple Message framework v606)
Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-2--153422392; protocol="application/pkcs7-signature"
Message-Id: <CFFAB8F8-25EB-11D8-B07E-000A958E58CC@raibledesigns.com>
Cc: Tomcat Users List <tomcat-user@jakarta.apache.org>
From: Matt Raible <matt@raibledesigns.com>
Subject: Re: servlet sendRedirect() to j_security_check problem (remember me)
Date: Wed, 3 Dec 2003 16:52:54 -0700
To: Adam Hardy <ahardy.struts@cyberspaceroad.com>
X-Mailer: Apple Mail (2.606)
X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N
X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N

--Apple-Mail-2--153422392
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
        charset=US-ASCII;
        format=flowed

It's standard container managed security stuff - I first invoke a
protected URL - in index.jsp - I redirect to mainMenu.do - and *.do is
protected.  Based on security constraints in web.xml, I'm presented
with a form-login-page "login.jsp" - rather than having
action="j_security_check" in this form, I have
action="/security/authorize" - which is mapped to my own LoginServlet.
In the LoginServlet, I encrypt the password (optionally based on an
init-parameter), set some cookies and do an HTTP Post to
j_security_check.  Works on Tomcat 4-5 and Resin 3.x.

Matt

On Dec 3, 2003, at 4:21 PM, Adam Hardy wrote:

> Matt,
> are you really managing to post a form to j_security_check without
> invoking it first, or is that some sort of black magic you've cooked
> up?
>
> Or have I just misunderstood what Chris said?
>
> Adam
>
> On 12/03/2003 09:24 PM Matt Raible wrote:
>> Chris,
>> I found your post at
>> http://www.mail-archive.com/tomcat-user%40jakarta.apache.org/
>> msg111700.html and I'm cc'ing the list in case anyone else is
>> interested in this info (I'm not subscribed).
>> I've actually improved the "Remember Me" feature a fair amount since
>> I  posted to the Tomcat User list.  The sendRedirect works, however,
>> it  (in some browsers) puts the URL (with password) into the address
>> bar.   This isn't a big deal IMO since it's the user that just logged
>> in and  they don't mind seeing their own passwords.  However, the URL
>> tends to  show up in server log files which can be a security hole.
>> Because of  this, I changed to using an HTTP Post with Jakarta
>> Common's HttpClient.   I also moved my form-login-page and
>> form-error-page into a "security"  folder and then set my cookies for
>> the /appname/security path rather  than / - this makes it so the
>> user/pass cookies are more secure and can  only be retrieved when
>> logging in, rather than for any URL in the site.
>> That being said, I've updated one of my sample apps with these
>> changes  and you can download it if you'd like:
>> http://raibledesigns.com/wiki/Wiki.jsp?page=AppFuse
>> Here's my updated LoginServlet that does an Http Post instead of a
>> Get:
>> http://tinyurl.com/xl80
>> HTH,
>> Matt
>> On Dec 3, 2003, at 12:52 PM, Chris Ward wrote:
>>>
>>> Hi Matt,
>>>
>>> Sorry for sending unsolicited email but I've been looking at some
>>> of your postings to Tomcat-User and wondered if I could ask a
>>> couple of questions.  I've tried posting to list but had no response
>>> from anyone there.
>>>
>>> Specifically, it's regarding your "remember me" login stuff.  If this
>>> is a pain feel free to ignore this email.
>>>
>>>
>>> Best regards
>>> Chris
>>>
>>> p.s. My question the list was under the subject
>>> "servlet sendRedirect() to j_security_check problem"
>
>
> --
> struts 1.1 + tomcat 5.0.14 + java 1.4.2
> Linux 2.4.20 RH9

--Apple-Mail-2--153422392
Content-Transfer-Encoding: base64
Content-Type: application/pkcs7-signature;
        name=smime.p7s
Content-Disposition: attachment;
        filename=smime.p7s


BmbLXHbXHCbbYbr/kTH6IEGCgZWZxi7RSeJUa+HmAAAAAAAA

--Apple-Mail-2--153422392--