This week's book giveaway is in the OCMJEA forum.
We're giving away four copies of OCM Java EE 6 Enterprise Architect Exam Guide and have Paul Allen & Joseph Bambara on-line!
See this thread for details.
The moose likes Tomcat and the fly likes Invalid direct reference to form login page Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of OCM Java EE 6 Enterprise Architect Exam Guide this week in the OCMJEA forum!
JavaRanch » Java Forums » Products » Tomcat
Bookmark "Invalid direct reference to form login page" Watch "Invalid direct reference to form login page" New topic
Author

Invalid direct reference to form login page

Steffen Foldager
Ranch Hand

Joined: Mar 22, 2001
Posts: 58
I am developing an application using form-based uthorization in Tomcat 4.0.3.
(My basic problem is that I want to log out, but until then I have another problem first..)
In my web.xml I have defined the login page:
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/loginError.jsp</form-error-page>
</form-login-config>
</login-config>

The login page basically consist of the standard
<form name="loginForm" method="POST" action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">
<input type="submit" value="Login Now">
</form>
It all works fine. When I try to access web-resource-collections protected by a security-constraint in web.xml I get redirected to login.jsp.
But if I go to login.jsp directly I get this strange behavior:
When entering correct user/pwd I get the error message "Apache Tomcat/4.0.3 - HTTP Status 400 - Invalid direct reference to form login page". But when entering an incorrect user/pwd I get send to the loginError.jsp page. Which means that at least the user/pwd get checked.
So can I or can't I link directly to the login.jsp page and perform a login? Any ideas?
/Steffen


Steffen Foldager<p>Sun Certified Java Programmer<br />Sun Certified Web Component Developer
Tim Holloway
Saloon Keeper

Joined: Jun 25, 2001
Posts: 16022
    
  20

You can't simply point a browser at the login page because there's no way to tell it where to got next! The login page's action is a builtin process, not a servlet or JSP that could then move you along to the next page.
The idea behind the login facility is that since a user can jump into any part of a webapp that has a distinct URL, thus bypassing a login page, the whole login process is moved external to the webapp so that if someone addresses the webapp and they are not yet logged in, the original URL is intercepted, the login form is presented, and if (and ONLY if) the login succeeds will the original URL be presented.
I also discovered to my pain that in Tomcat, a login form containing page-external references (such as CSS links) loses that saved URL, so it's best to keep the login page plain.


Customer surveys are for companies who didn't pay proper attention to begin with.
Steffen Foldager
Ranch Hand

Joined: Mar 22, 2001
Posts: 58
Thanks Tim.
That is a good reason why the authorization is happening outside the web application, I didn't think of that.
But still it doesn't solve my initial problem: I want to be able to log out. Without closing the browser which is currently my only option.
/Steffen
Rajkiran Bande
Greenhorn

Joined: Jun 08, 2011
Posts: 2

@Tim Holloway :
Thank you. You are right? But is there any way we can call external files such as CSS or images for buttons etc? Any kind of help will be highly appreciated. Thank you in advance.

--

Regards,

Rajkiran Bande.


--

Regards,

Rajkiran Bande.
Tim Holloway
Saloon Keeper

Joined: Jun 25, 2001
Posts: 16022
    
  20

2003? That goes beyond "resurrecting a zombie" right into reincarnation!

References to JavaScript, css, images and so forth are done by URLs on the returned login page and are handled by the user's browser. The only restriction is that these URLs cannot reference secured resources, since secured resources are unavailable until the user has actually logged in.
Rajkiran Bande
Greenhorn

Joined: Jun 08, 2011
Posts: 2

Thanks you.
ajay mittal
Greenhorn

Joined: Nov 23, 2011
Posts: 24
Hi,

This is caused by directly refering to the login URL. Instead, you should go to a protected resource, such as Main.jsp. If login is required, this will redirect you to the login page. The "j_security_check" URL is a kind of temporary resource that only exists.if the tomcat decided that the login page should be shown.

For example -
if the protected resource is main.jsp

Then you should not specify the login.jsp in <welcome-file-list> in web.xml, instead you should specify the main.jsp.

Ajay Mittal
 
With a little knowledge, a cast iron skillet is non-stick and lasts a lifetime.
 
subject: Invalid direct reference to form login page