dimanche 17 mai 2015

Tomcat valve JAAS : form error page displayed first before response reaches back to Tomcat valve

Using form-based authentication.

1. web.xml

<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
  <form-login-page>/login.jsp</form-login-page>
  <form-error-page>/login-redirect-error.jsp?error=true</form-error-page>
</form-login-config>
</login-config>

2. Custom valve and defined in META-INF/context.xml

public class SecurityValve extends ValveBase {

public void invoke(Request request, Response response) throws IOException, ServletException {
    getNext().invoke(request, response);   
    system.out.println("after getNext()"); --> break point (BP)
}

}

Understanding of flow:
1. request --> valve --> JAAS --> Filter --> Servlet/JSP
2. response <-- valve <-- JAAS <-- Filter <-- Servlet/JSP

What i noticed:
1. Did a break point on SecurityValve (indicated at BP)
2. On forms, i purposely enter wrong credential and submit
3. Break point stops at BP
4. login-redirect-error.jsp displayed already
5. Since it stop at break point BP in SecurityValve, the response back to client flow has not reached the browser. Yet the login-redirect-error.jsp is already displayed

Question:
How can the login-redirect-error.jsp be displayed on the browser when the response flowing back to client stop at break point BP? The flow back to the client is not fully done yet.

Aucun commentaire:

Enregistrer un commentaire