Java EE 8 Design Patterns and Best Practices

Explaining form authentication

Form-based authentication is an authentication mechanism that uses forms to request a username and password, allowing the developer to customize the login and error screen. When a user requests access to a protected resource, the authentication mechanism sends a login page to the user, who then inputs the username and password and sends them to the server. If the username or password is not correct, the server will return the error page or return the requested resource. This mechanism is not safe either, because the username and password are also easily captured in this way, making a man-in-the-middle attack possible. As mentioned in the previous section, it is recommended to use a secure transport mechanism, ...