File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Web Component Certification (SCWCD/OCPJWCD) and the fly likes Which authentication method to choose ? Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Murach's Java Servlets and JSP this week in the Servlets forum!
JavaRanch » Java Forums » Certification » Web Component Certification (SCWCD/OCPJWCD)
Bookmark "Which authentication method to choose ?" Watch "Which authentication method to choose ?" New topic
Author

Which authentication method to choose ?

Sreedevi Vinod
Ranch Hand

Joined: Jan 17, 2005
Posts: 117
I have been reading about the different authentication types - form, basic, digest and client-cert and I have a basic doubt. It says that form and basic methods are not secure. Digest method is not supported by all containers. Client-cert is the only one left, but it requires client side certificates.
Suppose I want an aunthentication method which is secure, but I don't want to go into the hassle of client side certificates etc. then which one would I choose ? For example, my bank uses JSPs in their online banking system. It is secure (encrypted etc), but no cient side certificates or anything is used. How would they be managing that ? Same way for all these e-mail sites, where security is very important.

Please do send in your valuable insights on this.

Thanks
Devi
Sebastien Col
Greenhorn

Joined: Aug 18, 2005
Posts: 13
Hi,
you can secure the FORM method using a protected transport layer connection. Most containers use HTTPS over SSL to implement this layer.

You can tell the container that you want confidentiality an d integrity by adding the <user-data-constraint> tag to the apprapriate <security-constraint>.

For example :
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>

Sebastien
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: Which authentication method to choose ?
 
Similar Threads
Question on security
BASIC - FORM - DIGEST - CLIENT CERT In Deployment Descriptor
authentication mechanism in mini-browsers
Which authentication method to use ?
Security question