A question anoying me

[Lei Xiaowen]

In form-based authentication, what must be included in the HTML returned from the URL specified by the <login-page> element?
A. a base-64 encoded user name and password
B. a form that POSTs to the j_security_check URL
C. an applet that requests the user name and password from the user
D. a hidden field that supplies the login-constraint used by the application

and why?

[Leandro Melo]

Answer: a form that POSTs to the j_security_check

The URL specified as the login page must return a form with fields j_username and j_password. Adittionally, this form should POST to action="j_security_check".