Java Learning Notes

Note Authentication mechanism (authentication): Identify a user with the identity they claim
Does the application care if the user passes validation without caring how the validation is done???
Authorization (Access Control: Authorization): ★ Insist on using <security-role> to declare all roles
Provision of user information:

Preferred authentication provided by the container: (with static characteristics; efficiency?) ）
A.http Basic authentication: Usr/pwd joins a request header by BASE64 encoding
B.http Digest Authentication (DIGEST): (HTTP1.1 Support) MD5 summary from server-side validation clients (including server-side-contained nonce with timestamp, request resource, Server identity)
C.https Client Authentication (Client-cert): Requires SSL for the client
D. form-based authentication (form): The servlet specification is unique, implemented by the servlet container itself, plaintext transfer (specifically to implement the settings of <form-login-config> in dependencies <login-config> elements)

The access control type is defined by the WEB application configuration descriptor (in the servlet specification):/web-inf/web.xml
Access to User information: Request object provides methods to obtain authenticated user information (Servlet 2.2 API)

Application-controlled authentication: (Dynamic validation model), password still transmitted in clear text
Custom behavior <oar:validatesession name= "xxx" loginpage= "login.jsp" errormsg= "xxx"/> must be placed at the beginning of all protected pages in the application:
Includes 3 Required properties: Name of the Bean object created by the validation page
Login forwarding URL When the object name is not found
ERRORMSG the message displayed on the forwarded URL page
A page with access control as the Post request object needs to validate the Post method:
<% if (!request.getmethod (). Equals ("POST")) {%>
<ora:redirect page= "main.jsp"/>
<%}%>
Prevent users from submitting overdue forms again

Using HTTPS authentication will invalidate the other three authentication: whether it is authentication to the server or both to the client and server side, the connection is encrypted

Processing of cookies:
<ora:addcookie maxage= "2592000"/> Indicates that the cookie was saved for 30 days (30*24*3600s)
<ora:addcookie maxage= "0"/> indicates that the cookie is immediately invalidated