JavaServer Pages, 3rd Edition

Authenticating Users

The servlet specification (starting with Version 2.2), on which JSP is based, describes three authentication mechanisms supported by most web clients and web servers:

• HTTP basic authentication

• HTTP digest authentication

• HTTPS client authentication

In addition, it defines one mechanism that should be implemented by a compliant servlet container:

• Form-based authentication

HTTP basic authentication has been part of the HTTP protocol since the beginning. It’s a very simple and not very secure authentication scheme. When a browser requests access to a protected resource, the server sends back a response asking for the user’s credentials (username and password). The browser prompts the user for this information and sends the same request again, but this time with the user credentials in one of the request headers so the server can authenticate the user. The username and password are not encrypted, only slightly obfuscated by the well-known base64 encoding. This means it can easily be reversed by anyone who grabs it as it’s passed over the network. This problem can be resolved using an encrypted connection between the client and the server, such as the Secure Sockets Layer (SSL) protocol. We talk more about this in the last section of this chapter.

HTTP/1.1 introduced HTTP digest authentication. As with basic authentication, the server sends a response back to the browser when it receives a request for a protected resource. But with the response, it also sends a string ...