Using form-based authentication.
1. web.xml
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login-redirect-error.jsp?error=true</form-error-page>
</form-login-config>
</login-config>
2. Custom valve and defined in META-INF/context.xml
public class SecurityValve extends ValveBase {
public void invoke(Request request, Response response) throws IOException, ServletException {
getNext().invoke(request, response);
system.out.println("after getNext()"); --> break point (BP)
}
}
Understanding of flow:
1. request --> valve --> JAAS --> Filter --> Servlet/JSP
2. response <-- valve <-- JAAS <-- Filter <-- Servlet/JSP
What i noticed:
1. Did a break point on SecurityValve (indicated at BP)
2. On forms, i purposely enter wrong credential and submit
3. Break point stops at BP
4. login-redirect-error.jsp displayed already
5. Since it stop at break point BP in SecurityValve, the response back to client flow has not reached the browser. Yet the login-redirect-error.jsp is already displayed
Question:
How can the login-redirect-error.jsp be displayed on the browser when the response flowing back to client stop at break point BP? The flow back to the client is not fully done yet.
Aucun commentaire:
Enregistrer un commentaire