Security configuration in Web. xml

Code in Web. xml

2. <security-constraint>
4. <display-name>
6. Baseporject</display-name>
8. <web-resource-collection>
10. <web-resource-name>baseproject</web-resource-name>
12. <url-pattern>*.jsp</url-pattern>
14. <url-pattern>*.do</url-pattern>
16. <http-method>get</http-method>
18. <http-method>put</http-method>
20. <http-method>head</http-method>
22. <http-method>trace</http-method>
24. <http-method>post</http-method>
26. <http-method>delete</http-method>
28. <http-method>options</http-method>
30. </web-resource-collection>
32. <auth-constraint>
34. <description>
36. Baseproject</description>
38. <role-name>all role</role-name>
40. </auth-constraint>
42. <user-data-constraint>
44. <transport-guarantee>none</transport-guarantee>
46. </user-data-constraint>
48. </security-constraint>
50. <login-config>

XML code

2. <!--four verification methods, attached at the end of the note-
4. <auth-method>form</auth-method>
6. <form-login-config>
8. <form-login-page>/login.html</form-login-page>
10. <form-error-page>/error.html</form-error-page>
12. </form-login-config>
14. </login-config>
16. <security-role>
18. <role-name>all role</role-name>
20. </security-role>

The purpose of the Security-constriaint element here is to indicate what authentication method is used by the server. This element should appear in Web. XML in front of the login-config. It contains a possible child element, namely: Web-resource-collection, Auth-constraint, User-data-constraint, and Display-name. They are described in the following subsections.
1. Web-resource-collection this element determines which resources should be protected, and all security-constraint elements must contain at least one web- Resource-collection. This element consists of an web-resource-name element that gives an arbitrary identity name, a url-pattern element that determines which URL should be protected, an HTTP command that states that this protection applies (GET, post, and so on). The Http-method element of the default is all methods) and an optional description element that provides data.
It is important to note that Url-pattern only applies to clients that directly access these resources. In particular, it is not suitable for pages accessed through the MVC architecture using RequestDispatcher, or for pages that are not suitable for access using a similar jsp:forward approach.


2. The Auth-constraint element indicates which users should have access to protected resources. This element should contain one or more identities that have access to the user class Role-name element, and a description element that contains (optionally) a description role.

3. User-data-constraint
This optional element indicates that any transport layer protection is used when accessing related resources. It must contain a transport-guarantee child element (a valid value of none, integral, or confidential) and optionally contain a description element. The Transport-guarantee value of none will limit the communication protocol used. The integral value means that the data must be transmitted in a way that prevents the person who intercepts it from reading it. Although the rationale (and in the future HTTP version), there may be differences between integral and confidential, in the current practice, they are simply required to use SSL.

=========================================================

Four types of authentication:

Basic:http specification, Base64
<web-app>
......
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
......
</web-app>

DIGEST:HTTP specification, data integrity is strong, but not SSL
<web-app>
......
<login-config>
<auth-method>DIGEST</auth-method>
</login-config>
......
</web-app>

CLIENT-CERT:J2EE specification, strong data integrity, public key (PKC)
<web-app>
......
<login-config>
<auth-method>Client-cert</auth-method>
</login-config>
......
</web-app>

FORM:J2EE specification, data integrity is very weak, no encryption, allowing a custom landing interface.
<web-app>
......
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.html</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
......
</web-app>

Here the form method needs to explain is the login page fixed element: login.html

<form name= "LoginForm" method= "post" action= "J_security_check" >

<input name= "J_username" type= "text" >

<input name= "J_password" type= "password" >

<input type= "Submit" value= "Login" >

</form>

The action of the form must be J_security_check, method= "POST", User name Name= "j_username", Password name= "J_password" These are fixed elements

Security configuration in Web. xml