It's not a secret anymore!
The moose likes Web Component Certification (SCWCD/OCPJWCD) and the fly likes Which authentication method to choose ? Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Certification » Web Component Certification (SCWCD/OCPJWCD)
Bookmark "Which authentication method to choose ?" Watch "Which authentication method to choose ?" New topic

Which authentication method to choose ?

Sreedevi Vinod
Ranch Hand

Joined: Jan 17, 2005
Posts: 117
I have been reading about the different authentication types - form, basic, digest and client-cert and I have a basic doubt. It says that form and basic methods are not secure. Digest method is not supported by all containers. Client-cert is the only one left, but it requires client side certificates.
Suppose I want an aunthentication method which is secure, but I don't want to go into the hassle of client side certificates etc. then which one would I choose ? For example, my bank uses JSPs in their online banking system. It is secure (encrypted etc), but no cient side certificates or anything is used. How would they be managing that ? Same way for all these e-mail sites, where security is very important.

Please do send in your valuable insights on this.

Sebastien Col

Joined: Aug 18, 2005
Posts: 13
you can secure the FORM method using a protected transport layer connection. Most containers use HTTPS over SSL to implement this layer.

You can tell the container that you want confidentiality an d integrity by adding the <user-data-constraint> tag to the apprapriate <security-constraint>.

For example :

I agree. Here's the link:
subject: Which authentication method to choose ?
jQuery in Action, 3rd edition