|
1
28
29 package com.caucho.server.security;
30
31 import com.caucho.log.Log;
32 import com.caucho.server.connection.CauchoResponse;
33 import com.caucho.server.webapp.Application;
34 import com.caucho.server.webapp.RequestDispatcherImpl;
35 import com.caucho.util.L10N;
36
37 import javax.servlet.GenericServlet  ;
38 import javax.servlet.RequestDispatcher ;
39 import javax.servlet.ServletException ;
40 import javax.servlet.ServletRequest ;
41 import javax.servlet.ServletResponse ;
42 import javax.servlet.http.HttpServletRequest ;
43 import javax.servlet.http.HttpServletResponse ;
44 import javax.servlet.http.HttpSession ;
45 import java.io.IOException ;
46 import java.security.Principal ;
47 import java.util.logging.Level ;
48 import java.util.logging.Logger ;
49
50 public class FormLoginServlet extends GenericServlet {
51 private final Logger log = Log.open(FormLoginServlet.class);
52 static final L10N L = new L10N(FormLoginServlet.class);
53
54 public void service(ServletRequest request, ServletResponse response)
55 throws ServletException , IOException
56 {
57 HttpServletRequest req = (HttpServletRequest ) request;
58 HttpServletResponse res = (HttpServletResponse ) response;
59
60 Application app = (Application) getServletContext();
61 FormLogin login;
62
63 if (! (app.getLogin() instanceof FormLogin))
64 throw new ServletException (L.l("FormLoginServlet requires a form login auth-type configuration at `{0}'",
65 app.getLogin().getAuthType()));
66 login = (FormLogin) app.getLogin();
67
68 if (login == null)
69 throw new ServletException (L.l("j_security_check requires a login"));
70
71 String username = request.getParameter("j_username");
72 String password = request.getParameter("j_password");
73
74 ServletAuthenticator auth = login.getAuthenticator();
75
76 Principal user = auth.login(req, res, app, username, password);
77
78 if (log.isLoggable(Level.FINE))
79 log.fine("auth: " + user);
80
81 if (user == null) {
82 String errorPage = login.getFormErrorPage();
84 RequestDispatcherImpl disp;
85 disp = (RequestDispatcherImpl) app.getRequestDispatcher(errorPage);
86
87 if (res instanceof CauchoResponse) {
89 ((CauchoResponse) res).killCache();
90 ((CauchoResponse) res).setNoCache(true);
91 }
92 else {
93 res.setDateHeader("Expires", 0);
94 res.setHeader("Cache-Control", "no-cache");
95 }
96
97 disp.error(req, res);
98 return;
99 }
100
101 HttpSession session = req.getSession();
102
103 String uri = (String ) session.getValue(FormLogin.LOGIN_SAVED_PATH);
104 String query = (String ) session.getValue(FormLogin.LOGIN_SAVED_QUERY);
105
106 session.removeAttribute(FormLogin.LOGIN_SAVED_PATH);
107 session.removeAttribute(FormLogin.LOGIN_SAVED_QUERY);
108
109 if (log.isLoggable(Level.FINE)) {
110 log.fine("old path:" + uri + " query:" + query + " j_uri:" +
111 req.getParameter("j_uri"));
112 }
113
114 boolean formURIPriority = login.getFormURIPriority();
115
116 if ((uri == null || formURIPriority) && req.getParameter("j_uri") != null)
118 uri = req.getParameter("j_uri");
119 else if (uri != null && query != null)
120 uri = uri + "?" + query;
121
122 if (uri == null)
123 throw new ServletException (L.l("No forwarding URI for form authentication. Either the login form must specify j_uri or the session must have a saved URI."));
124
125 if (uri.indexOf('\n') >= 0 || uri.indexOf('\r') >= 0)
126 throw new ServletException (L.l("Forwarding URI '{0}' is invalid.",
127 uri));
128
129 String uriPwd = req.getRequestURI();
130 int p = uriPwd.indexOf("/j_security_check");
131 if (p >= 0)
132 uriPwd = uriPwd.substring(0, p + 1);
133
134 if (uri.length() == 0) {
135 }
136 else if (uri.charAt(0) == '/')
137 uri = req.getContextPath() + uri;
138 else if (uri.indexOf(':') >= 0 &&
139 (uri.indexOf(':') < uri.indexOf('/') ||
140 uri.indexOf('/') < 0)) {
141 }
142 else {
143 uri = uriPwd + uri;
144 }
145
146
150 boolean useInternalForward = login.getInternalForward();
153
154 if (useInternalForward &&
155 uri.startsWith(uriPwd) && uri.indexOf('/', uriPwd.length() + 1) < 0) {
156 Application newApp = (Application) app.getContext(uri);
157 String suffix = uri.substring(newApp.getContextPath().length());
158
159 RequestDispatcher disp = newApp.getLoginDispatcher(suffix);
162 if (disp != null) {
163 disp.forward(req, res);
164 return;
165 }
166 }
167
168 res.sendRedirect(res.encodeRedirectURL(uri));
169 }
170 }
171 |
Popular Tags |
Java API By Example, From Geeks To Geeks.