Re: Form Based Authentication creates user session before it is authenticated?

2009-05-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Martin, On 5/13/2009 9:27 AM, Martin Gainty wrote: > if you are asking how to overcome Man-in-the-middle fraudulent > manipulation based on basic authentication? He's not. > and or Man-in-the middle > fraudulent manipulation based on Form-based auth

Re: Form Based Authentication creates user session before it is authenticated?

2009-05-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chuck, On 5/13/2009 8:16 AM, Caldarale, Charles R wrote: >> From: umeshkavade [mailto:umeshkav...@yahoo.co.in] >> Subject: Re: Form Based Authentication creates user session before it >> is authenticated? >> >> P.S: BTW,

RE: Form Based Authentication creates user session before it is authenticated?

2009-05-13 Thread Martin Gainty
; Date: Wed, 13 May 2009 07:16:50 -0500 > Subject: RE: Form Based Authentication creates user session before it is > authenticated? > > > From: umeshkavade [mailto:umeshkav...@yahoo.co.in] > > Subject: Re: Form Based Authentication creates user session before it >

RE: Form Based Authentication creates user session before it is authenticated?

2009-05-13 Thread Caldarale, Charles R
> From: umeshkavade [mailto:umeshkav...@yahoo.co.in] > Subject: Re: Form Based Authentication creates user session before it > is authenticated? > > P.S: BTW, is Tomcat planning to resolve this vulnerability in near > future? I'll bite: what "vulnerability" are y

Re: Form Based Authentication creates user session before it is authenticated?

2009-05-12 Thread umeshkavade
Christopher, I got the solution. Thanks. Umesh -- View this message in context: http://www.nabble.com/Form-Based-Authentication-creates-user-session-before-it-is-authenticated--tp23455945p23515281.html Sent from the Tomcat - User mailing list archive at Nabble.com. ---

Re: Form Based Authentication creates user session before it is authenticated?

2009-05-12 Thread umeshkavade
>No, you'd have to write your own authentication mechanism. Tomcat is >required to store the request that triggered authentication for re-play >after a successful authentication. If not the request, where else should >it be stored? Christopher, thanks for the reply. This is inline with my analys

Re: Form Based Authentication creates user session before it is authenticated?

2009-05-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Umesh, On 5/8/2009 9:03 PM, umeshkavade wrote: > In my web application, I am using tomcat's form based authentication for > protecting my secure web pages. Thus whenever user starts accessing webapp > by providing an URL of protected page, it is redir

RE: Form Based Authentication creates user session before it is authenticated?

2009-05-09 Thread Martin Gainty
er.com > To: users@tomcat.apache.org > Subject: Re: Form Based Authentication creates user session before it is > authenticated? > > Pid wrote: > > umeshkavade wrote: > >> Hello, > >> > >> In my web application, I am using tomcat's form based au

Re: Form Based Authentication creates user session before it is authenticated?

2009-05-09 Thread Pid
Pid wrote: > umeshkavade wrote: >> Hello, >> >> In my web application, I am using tomcat's form based authentication for >> protecting my secure web pages. Thus whenever user starts accessing webapp >> by providing an URL of protected page, it is redirected to login page. >> However, while doing so

Re: Form Based Authentication creates user session before it is authenticated?

2009-05-09 Thread Pid
umeshkavade wrote: > Hello, > > In my web application, I am using tomcat's form based authentication for > protecting my secure web pages. Thus whenever user starts accessing webapp > by providing an URL of protected page, it is redirected to login page. > However, while doing so it creates a sess