Re: SecurityFilter and Cookies

Sorry, but you are not offering a lot of information to go by......

We can elaborate on: < add your validation code here to check cookie >

What does your cookie look like ?
What does your database look like ?

Are you writing a java application from scratch or are you trying to
install something that already exists ?


Will your application ever call
javax.servlet.http.HttpServletRequest.getRemoteUser()
   -or-
 javax.servlet.http.HttpServletRequest.isUserInRole(java.lang.String role)  ?


-Steve


On Wed, Jul 16, 2008 at 8:36 AM, Emsley, I (Iain) <I.Ems.......k> wrote:
> Hi Steve,
>
> Pretty much but I also need to authorise it against a role set in a db
> as well otherwise the application won't let it in which is why I was
> taking a look at SecurityFilter as an option.
>
> Iain
>
> -----Original Message-----
> From: Stephen More [mailto:steph.........com]
> Sent: 14 July 2008 19:30
> To: Emsley, I (Iain)
> Cc: securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> Subject: Re: [securityfilter-user] SecurityFilter and Cookies
>
> Are these assumptions correct:
>   1. The cookie is being generated on some third party server/system
>   2. You need to validate the cookie against this third party server
>
> If so this seems like a simple Filter you can just write from scratch:
>
> public class TPSFilter implements javax.servlet.Filter {
>     public void doFilter( javax.servlet.ServletRequest request,
> javax.servlet.ServletResponse response, javax.servlet.FilterChain
> chain) throws java.io.IOException, javax.servlet.ServletException
>    {
>          javax.servlet.http.HttpServletRequest req =
> (javax.servlet.http.HttpServletRequest)request;
>          javax.servlet.http.Cookie[] cookies = req.getCookies();
>
>           < add your validation code here to check cookie >
>          if( ! valid )
>          {
>               return();
>          }
>
>          chain.doFilter( request, response );
>
>    }
> }
>
> -Steve
>
> On Mon, Jul 14, 2008 at 9:23 AM, Emsley, I (Iain) <I.Ems....uk> wrote:
>> Hi,
>>
>> I'm currently working on a project which requires that users be able
>> to login in to some resources on Tomcat using only their cookie, i.e.
>> no forms if the cookie is valid and an error page if it isn't, which
>> is derived from a system running on Apache. I'm still fairly new to
>> the worlds of Tomcat and authentication/authorisation.
>>
>> I've had SecurityFilter suggested to me to do this but is it an
>> appropriate solution before I get too deep into it?
>>
>> I've just downloaded the source files and begun working on a Cookie
>> Authenticator, derived from the Form Authenticator, which reads the
>> cookies and then sets the Principals but so far have just managed:
>> java.lang.ClassCastException:
>> org.securityfilter.authenticator.CookieAuthenticator cannot be cast to
>
>> javax.servlet.Filter. I suspect that I haven't quite got it correctly
>> set up on my server.
>>
>> I'd be grateful for any pointers.
>>
>> Thanks in advance,
>>
>> Iain
>>
>> Iain Emsley
>>
>>
>> ----------------------------------------------------------------------
>> --- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
>> Studies have shown that voting for your favorite open source project,
>> along with a healthy diet, reduces your potential for chronic lameness
>
>> and boredom. Vote Now at http://www.sourceforge.net/community/cca08
>> _______________________________________________
>> securityfilter-user mailing list
>> securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
>> https://lists.sourceforge.net/lists/listinfo/securityfilter-user
>>
>>
>

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/