Use the servlet filter to protect static& dynamic web contents
Use the servlet filter to protect static& dynamic web contents
My customer want to using web.xml configuration to protect static& dynamic web contents
Wls support the login-config to do this , but this depend the j_security_check,can only authen inner role & principle
if you want to use external authen , we advise using the servlet filter to so this :
in web.xml :
<filter>
<filter-name>loginFilter</filter-name>
<filter-class>loginFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>loginFilter</filter-name>
<url-pattern>/admin/*</url-pattern>
</filter-mapping>
loginFilter.java 's doFilter method :
public void doFilter(ServletRequest req, ServletResponse res, FilterChain fc)
throws java.io.IOException, javax.servlet.ServletException {
HttpSession sess = ((HttpServletRequest)req).getSession(true);
String auth = (String)sess.getAttribute("authenticated");
if(auth == null || auth.equals("false")) {
((HttpServletResponse)res).sendRedirect("/login.jsp?path_context="+URLEncoder.encode(((HttpServletRequest)req).getRequestURI()+"?"+((HttpServletRequest)req).getQueryString()));
return;
}
fc.doFilter(req,res);
}
then wrapper the authen in the authenticate.jsp ,which is the login.jsp 's action file
<%@page import="java.net.URLDecoder"%>
<%
//authen the user
//.....put your authen method , I just give a example
boolean authenticated=false;
if (request.getParameter("username").equals("abc") && request.getParameter("password").equals("abc") )
authenticated = true;
//*******************
if (authenticated) {
(request.getSession(false)).setAttribute("authenticated", "true");
response.sendRedirect(URLDecoder.decode(request.getParameter("path_context")));
}
else {
(request.getSession(false)).setAttribute("authenticated", "false");
response.sendRedirect("/error.jsp?path_context="+request.getParameter("path_context"));
}
%>
finally the login.jsp :
<form method="post" action="/authenticate.jsp">
<table border="0" bgcolor=#eeeeee align=center cellspacing=10>
<tr>
<td>Username:</td>
<td>
<input type="TEXT" name="username">
</td>
</tr>
<tr>
<td>Password:</td>
<td>
<input type="PASSWORD" name="password">
</td>
</tr>
</table>
<p>
<center>
<input type="SUBMIT" name="submit" value="Login">
<input type="hidden" name="path_context" value="<%=request.getParameter("path_context")%>">
</center>
</form>
