Re: handling form based authentication w/ remember-me cookie

2004-01-14 Thread Nadeem Bitar
[EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 6:16 PM Subject: Re: handling form based authentication w/ remember-me cookie Quoting [EMAIL PROTECTED]: Are Servlet filters supposed to be called for both GET and POST methods? They seem to be getting called for GETs only

Re: handling form based authentication w/ remember-me cookie

2004-01-14 Thread Matt Raible
On Jan 14, 2004, at 3:52 AM, Nadeem Bitar wrote: A note about storing passwords in cookies. Encode the password. Do not store the userid with the password in the cookie, store some id associated with the user id. You can generate a one-way hash (MD5) of the contents of the cookie with a secret

RE: handling form based authentication w/ remember-me cookie

2004-01-14 Thread Dhaliwal, Pritpal (HQP)
Dhaliwal -Original Message- From: Matt Raible [mailto:[EMAIL PROTECTED] Sent: Wednesday, January 14, 2004 5:28 AM To: Struts Users Mailing List Subject: Re: handling form based authentication w/ remember-me cookie On Jan 14, 2004, at 3:52 AM, Nadeem Bitar wrote: A note about storing

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Craig R. McClanahan
To: Struts Users Mailing List Subject: handling form based authentication w/ remember-me cookie I am using Struts and building a logon page to do Form-based authentication under Tomcat. I want to also have a checkbox for the user to check that says remember me so that I can send them

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Matt Raible
On Jan 13, 2004, at 12:42 AM, Craig R. McClanahan wrote: Filters are *not* required to be invoked on j_security_check invocations. In fact, Tomcat won't even enable the j_security_check url unless an unauthenticated user accesses a protected resource. Basically, I believe there is no

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Martin Gainty
based authentication w/ remember-me cookie On Jan 13, 2004, at 12:42 AM, Craig R. McClanahan wrote: Filters are *not* required to be invoked on j_security_check invocations. In fact, Tomcat won't even enable the j_security_check url unless an unauthenticated user accesses a protected

RE: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Parmar, Dipakkumar
] Subject: Re: handling form based authentication w/ remember-me cookie Dipak, Are you certain that the filter will be invoked on the /j_security_check request when container-based security is used? I have not tested this, but it would not surprise me to find that some containers do not execute filters

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread cruegger
' Subject: RE: handling form based authentication w/ remember-me cookie Hi Max, I haven't tested it either. I read it about this in IBM WebSphere V5.0 Security handbook (page 64). Regards, Dipak Parmar -Original Message- From: Max Cooper [mailto:[EMAIL PROTECTED] Sent: Monday

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Craig R. McClanahan
-Original Message- From: Parmar, Dipakkumar [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 03:57 PM To: 'Struts Users Mailing List' Subject: RE: handling form based authentication w/ remember-me cookie Hi Max, I haven't tested it either. I read it about

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Nadeem Bitar
To: Struts Users Mailing List; [EMAIL PROTECTED] Subject: Re: handling form based authentication w/ remember-me cookie Dipak, Are you certain that the filter will be invoked on the /j_security_check request when container-based security is used? I have not tested

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Chris Ruegger
] Sent: Tuesday, January 13, 2004 6:16 PM Subject: Re: handling form based authentication w/ remember-me cookie Quoting [EMAIL PROTECTED]: Are Servlet filters supposed to be called for both GET and POST methods? They seem to be getting called for GETs only on Tomcat 5. -Chris For filters

Re: handling form based authentication w/ remember-me cookie

2004-01-13 Thread Matt Raible
to be getting called for GETs only on Tomcat 5. -Chris -Original Message- From: Parmar, Dipakkumar [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 03:57 PM To: 'Struts Users Mailing List' Subject: RE: handling form based authentication w/ remember-me cookie Hi Max, I haven't

handling form based authentication w/ remember-me cookie

2004-01-12 Thread Chris Ruegger
I am using Struts and building a logon page to do Form-based authentication under Tomcat. I want to also have a checkbox for the user to check that says remember me so that I can send them a cookie. I'm not sure how to intercept the form values because I have to post to j_security_check. How can

RE: handling form based authentication w/ remember-me cookie

2004-01-12 Thread Parmar, Dipakkumar
Mailing List Subject: handling form based authentication w/ remember-me cookie I am using Struts and building a logon page to do Form-based authentication under Tomcat. I want to also have a checkbox for the user to check that says remember me so that I can send them a cookie. I'm not sure how

RE: handling form based authentication w/ remember-me cookie

2004-01-12 Thread Richard Hightower
form based authentication w/ remember-me cookie I am using Struts and building a logon page to do Form-based authentication under Tomcat. I want to also have a checkbox for the user to check that says remember me so that I can send them a cookie. I'm not sure how to intercept the form values

RE: handling form based authentication w/ remember-me cookie

2004-01-12 Thread Richard Hightower
form based authentication w/ remember-me cookie I am using Struts and building a logon page to do Form-based authentication under Tomcat. I want to also have a checkbox for the user to check that says remember me so that I can send them a cookie. I'm not sure how to intercept the form values

Re: handling form based authentication w/ remember-me cookie

2004-01-12 Thread Max Cooper
- Original Message - From: Parmar, Dipakkumar [EMAIL PROTECTED] To: Struts Users Mailing List [EMAIL PROTECTED] Sent: Monday, January 12, 2004 7:43 AM Subject: RE: handling form based authentication w/ remember-me cookie Hi Chris, You can do this using Servlet Filter. What you need

Re: handling form based authentication w/ remember-me cookie

2004-01-12 Thread Matt Raible
] To: Struts Users Mailing List [EMAIL PROTECTED] Sent: Monday, January 12, 2004 7:43 AM Subject: RE: handling form based authentication w/ remember-me cookie Hi Chris, You can do this using Servlet Filter. What you need to do is write postLoginFilter that maps to the j_security_check url. In doFilter