O'Reilly logo

Java Servlet & JSP Cookbook by Bruce W. Perry

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

15.4. Using Form-Based Authentication

Problem

You want to design your own form to receive the user's name and password during BASIC authentication.

Solution

Use the login-config element in the deployment descriptor and give its nested auth-method element a value of "FORM".

Discussion

The servlet API offers an alternative to using plain-vanilla BASIC authentication: form-based authentication. This method allows you to design your own form for receiving the user's name and password, as well as specifying the informative page that the servers send to the client if the user's authentication fails. This gives you the ability to provide a much more friendly and customized user interface for applications involving BASIC authentication.

Tip

The form-based method should still be combined with SSL and the HTTPS protocol so that the names and passwords are encrypted as they travel through the network.

Example 15-5 shows the form-based setup for the web application's deployment descriptor. It differs from Recipe 15.3s setup in one area: the login-config element, which is emphasized in the following code sample.

Example 15-5. The web.xml elements designed for form-based authentication

<!-- Beginning of web.xml deployment descriptor --> <security-constraint> <web-resource-collection> <web-resource-name>JSP database component</web-resource-name> <url-pattern>/sqlJsp.jsp</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>dbadmin</role-name> ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required