Re: redirecting from a servlet to an exterior URL using a POST

> Garey - Yes we all agree that redirect will not do a POST.  The =
various suggestions=20
> that have been made all work, including using a programmatic post with =
Jakarta=20
> HttpClient.  One thing to be aware of is that POST is NOT a security =
mechanism.=20
> Even though the parameters do not show on the URL as with a GET, it is =
still fairly=20
> easy to see these values with a POST for someone who goes to a little =
trouble.  So=20
> if you have a security reason for this question your premise was not =
correct. Still,=20
> the HttpClient or HttpURLConnection approaches seem like they will do =
what you=20
> are trying to do.

Good answer! It addresses most of my concerns I've had while following =
this thread.
Here are some more thoughts of mine:

I assume the OP has no control over the university service, otherwise he =
could use=20
some cryptographic method, like a shared secret, to issue a ticket in =
his servlet and=20
pass it to the client.

Another thing the OP didn't make clear was how the university service =
handles=20
sessions. If it is protected against session hijacking (for example if =
it relies on the web=20
servers session management) and compares the IP of the requesting end =
between calls=20
in a session, there could be a problem. It will find that the IP of the =
first request (the=20
login) is different from that of the subsequent requests. However, if =
the univerity=20
service is not protected against session hijacking it will probably =
work. Though, it=20
puts you in a moral dilemma of whether or not to contact them about it =
or having your=20
own service work. :)

> BTW - I'm tempted to wonder - if anyone can use your system to login =
to the=20
> other system you might as well make a guest password public anyway!

Another of my concerns. :)

...johahn

___________________________________________________________________________
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff SERVLET-INTEREST".

Archives: http://archives.java.sun.com/archives/servlet-interest.html
Resources: http://java.sun.com/products/servlet/external-resources.html
LISTSERV Help: http://www.lsoft.com/manuals/user/user.html