Form based authentication

[shankar valiinaykam]

Hi,

P-700; Q-1 says Form based authentication is recommended only if cookies or SSL session tracking is enabled. Why is it like this, when URL rewriting is there to save us?

In security roles, i find one combination missing. If two security constraints are there for same resource as "*" and nobody <auth-constraint/> then who rules? Is it "everybody" or "nobody"?
My guess is : Nobody. Somebody, plz confirm.

Thanks,
Shankar

[shankar valiinaykam]

Oooops!!! I wanted to write P-667 and Q-9.

[Daniel Spaethe]

From my understanding, the reason they indicate that form based authentication should only be used wihen SSL session tracking is enabled is that out of the 4 types, BASIC, CLIENT-CERT, DIGEST and FORM, FORM is the least secure. The other 3 types provide at least some type of encryption.


As for your other qustion, an empty <auth-constraint/> tag will combine with anything else and will allow "nobody".

Dan

[Daniel Spaethe]

Sorry, meant to say that the FORM is the least secure of all:
BASIC - is encoded, but not encrypted. base 64
DIGEST - not widley used.. but more secure than BASIC
CLIENT-CERT - clients need a certificate on their side.
FROM - least secure of all 4