a simple idea is to change Login.tml to submit directly to acegi filter :
<form method="POST" action="/j_acegi_security_check">
<input type="text" name="j_username" />
<input type="password" name="j_password" />
<input type="submit" value="${message:login}"/>
</form>
On Jan 22, 2008 4:43 PM, Baptiste Meurant <[EMAIL PROTECTED]>
wrote:
>
> Hi,
>
> Thank you for this great work. It will be really useful.
>
> I still have a question about security T5/acegi integration : the
> "classic" solution that you used to perform strong authentication with
> acegi
> through T5 is creating a T5 LinkImpl object. You give then parameters
> (login
> and password) to this link object to pass the request to acegi.
>
> The problem is that you are the able to see login and password in clear in
> your server (Apache, Tomcat, ...) logs. Indeed, T5 uses a LinkImpl object
> to
> perform a GET (and not a POST) to server.
>
> I am very annoyed with this security hole that I have encountered on my
> own
> implementation of T5/acegi integration. I don't know any correct and
> elegant
> fix to this issue for now.
>
> Did you experiment this issue ? Do you have an idea on it ? Or maybe you
> found yet a solution to fix it ?
>
> Regards,
>
> Baptiste
>
>
>
> dalahoo wrote:
> >
> > Hi all,
> >
> > latest release of my phone book application is available now,
> >
> > In this release i used :
> >
> > - Tapestry 5.0.7 as a Web MVC framework.
> > - Acegi 1.0.5 as a Security System.
> > - Spring 2.5 as a Application framework.
> > - Spring JDBC for Data Access Layer.
> > - Hibernate 3.2.4 an alternative for Data Access Layer.
> > - JPA (Hibernate Implementation) another alternative for Data Access
> > Layer.
> > - HSQLDB 1.8.0.7 for application database.
> >
> > read more about application configuration at
> > http://code.google.com/p/shams/wiki/TASJHJ
> >
> > you can download source code for this release and previous releases from
> > http://code.google.com/p/shams/
> >
> >
> > --
> > sincerely yours
> > M. H. Shamsi
> >
> >
>
> --
> View this message in context:
> http://www.nabble.com/-T5--ANN----Tapestry%2BAcegi%2BSpring%2BJDBC%2BHibernate%2BJPA%2BHSQLDB-all-in-one-tp15017544p15018441.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
>
>
--
sincerely yours
M. H. Shamsi
