I'm trying to make a e-commerce page and I have a login form in all pages (included in the header). What I whant is to do a secure connection between the client and the server when the user logins for the password don't be sent in plain text string. The problem here is I don't want to use https for all pages, but just for the form submission.
Because I'm using spring security I did a little bit resarch and I found the requires-channel="https" for the intercept-url, but I notice that the form sent first the login information in plain text and just then the connections is "converted" to https.
One other way I found was to change the action of my form to use the https link
<form id="login" action="https://localhost:8443/j_spring_security_check" method="POST" >
Everything was sent in a secure way (like I expected), the loadUserByUsername is called, everything worked as expected, but when the job was done, the user appears to be not authenticated. Looks like nothing happens...
Maybe I'm missing something or I'm not following the right pad... someone knows what I need to do or point me in the right direction?
Edit: I dig a little bit more about this subject and I start wondering if the best will be to secure the full website rather than the login or registration form. This will be an e-commerce website, so a few extra security is always welcome. My worries are about the bennefits/performance (pros and cons) that the https will have compared to http use (anyone knows??) !!
After many days of researching and testing (almost a month) I arrived to conclusion that the best approach for this problem is not use a secure connection for the form but for the entire application (in my case need to be the entire because the login form is present in all app as a popup element).
For others, the reason to change was to give the customer the assurance that the data is secure and the website is trusted (the symbol in the address link)... Also, I read somewhere is good for SEO!!
I hope with this answer I could clarify someone with the same issue as mine!!
Related
I promised to do something, but my managers want assurance that it can be done. What seems like a simple task is surprisingly hard to find example of. It consists of:
The browser asks a Java servlet for access to a remote site.
The servlet opens a HttpUrlConnection to that remote site.
The servlet sends a login request to that remote site.
The servlet receives a login form.
The servlet populates the login form from user session data, then
POSTs it.
The servlet receives the "welcome" from the remote site, complete
with headers and cookies.
The request of step 1 is finally filled by the content, headers, and cookies from step 6.
I'm having trouble getting code examples, leading me to think that what I want to do can't be accomplished. Can someone point me to an example?
Thanks,
Jerome.
The main problem is the domain of the session cookie.
More accurately, the question is what you're planning next after step 7.
Say your servlet is at "https://mycompany.com/loginServlet", and the remote site is a toy store "https://toys.com". Were you hoping that after step 7, the browser could be redirected to "https://toys.com" and get a proper service befitting a logged-in user? This won't work because when the browser received a session cookie from "mycompany.com" (in step7), this cookie will be attached to further requests for "mycompany.com" - but not to "toys.com", it's a security feature for excellent reason.
In short, this approach might work if both the servlet and the toys site are on the same domain. Though it makes me a bit uncomfortable in terms of security and password management, but never mind.
Obviously this approach would also work in the (unrealistic) case of letting your server proxy all further requests from the browser to "toys.com", but that's unrealistic for a typical commercial site (due to relative/absolute links, ajaxes etc.).
If it's different domains, then I second the wise comment made by "Rahul B" above: please look into SSO, and/or check with "toys.com" what login mechanisms they offer - maybe they already have something like "login with google" that's convenient enough.
I'm working on a Java application that need's to be able to connect to my University's websites containing my student information. I'm not exactly sure how to go about doing this as the websites framework is Seam which I don't have any experience with.
This is the main link
https://elion.psu.edu/
and after clicking on student this is the link that I actually need to login to.
https://webaccess.psu.edu/?cosign-elionnx.ais.psu.edu&https://elionnx.ais.psu.edu/eLionStudent/secure/elionHome.seam
Does anyone know how to open the second link (student login page) and programmatically enter the username/password, thne 'click' log in?
There's a lot more stuff that needs to be done after the log in but I'm sure I can figure it out if someone could shed a little light on how I should go about doing this.
Thanks,
-Justin
Basically it looks like an application/x-www-form-urlencoded 'POST' to the URL:
https://webaccess.psu.edu/?cosign-elionnx.ais.psu.edu&https://elionnx.ais.psu.edu/eLionStudent/secure/elionHome.seam
It could be reproduced programatically by making an HTTP POST request (ensure to set the Content-Type Header to application/x-www-form-urlencoded) to that address, and posting the encoded form data. Which would look like this if you tried to submit the login 'asd' and password 'sdf':
ref=https%3A%2F%2Felionnx.ais.psu.edu%2FeLionStudent%2Fsecure%2FelionHome.seam&service=cosign-elionnx.ais.psu.edu&required=&login=asd&password=sdf
A good way to figure out this information (If you are using Chrome) is open the developer-tools and go to the network tab. Check the 'preserve-log' box and then try to submit something on the web page. The very first thing in the list for me was the POST request it attempted to login. By clicking on that you can see lots of detailed information about the actual request itself.
Hope this helps!
I am trying to update an app that I wrote for Android that will automatically log a user into a captive portal at my university. The app worked fine last year with the portal URL hard coded in, however this year that won't work because they changed the server URL, I know what the URL is, so I simply changed it in my program ... which sort of works
There are two main problems, for me, with this approach.
hard coding is a pain in the ass to do every year, I also want to be able to make it future proof, so that hard coding the URL won't be necessary
for some unexplainable reason there are actually buildings on campus that will direct to the OLD authentication server, it truly boggles my mind why it would do that
I would like to be able to make an HTTP request and get the URL of the captive portal that is redirected to, how is that done?
Captive portals generally will intercept users' HTTP requests and issue a "fake" redirect to the portal's authentication page. Or they can simply replace the actual response with the login page.
If yours is a redirect-to-login, then simply do something like trying to load http://google.com, which can reasonably be expected to be truly available for at least the next few years. If the response comes in as a redirect to some totally different site, the redirect url is highly likely to be the portal's login page.
If it's a replace-the-response-with-login, then you should try to contact a known page with some known content, and see what you get back. if the response you got doesn't match you should have gotten, then you've gotten the login page and can try tearing apart the response and finding the login form via DOM operations.
Captivate portals uses 2 methods.
as described above. http redirect so the gateway takes you to another address.
ICMP - sending "better route" message
Still from my exprience on cases where non simple redirect happens the approach of expecting the redirect won't work.
I am working on a homework assignment that is due shortly and I have searched and searched and searched for the answer to this and I just don't know where to go at this point.
I am using Eclipse Juno, with Tomcat 7.0 and a MySql database. I have to develop a web application for a pizza place. I have pretty much everything working so will only post the code here if requested since there is a ton.
My problem is I have a login form that calls the j_security_check, which works just fine. However, when the user is logged in they are taken to a customer form which is supposed to display their name, address, phone number and give them the option of editing any of it or just starting their order. My problem is I need to get the j_username and pull the customer information from my database to populate the form when the user is redirected from the login page to the customer.jsp page. We are not supposed to use <% ----- %> in our code if we can help it and to keep that in servlets. I just am lost on how to get that j_username and then call a servlet to populate the form (I can do the population if I can get the data).
HELP PLEASE!!! I know I am missing something really simple here and it is driving me nuts.
Ok I have tried the demo you sent and actually found another demo with the FORM like my project. I still cannot get it to work. I am a little lost. When I do the demo exactly as they have it the servlet generates text and outputs it. I was able to change it to a requestDispatcher and send it to the page I need it to go to on the login. The demo just has it going to the url host.../YourProject/test not an actual page. I am lost on how to get it to call the servlet so I can grab the header information with my project. I have the servlet LoginUser I want the user to login on login.jsp and there is a login_error.jsp in case of an error. When the user successfully log's in they should be taken to customer.jsp and the fields on the page populated with their data. I need to change this to use SSL too but haven't got there yet I am still trying to get the data for the customer.
I suspect what you're using is basic authentication in Tomcat. Check out this post for instructions. In summary, you'll need to grab the authentication header from the servlet request and parse it to grab the username (first you'll likely need to base64 decode it). Then you can use that username to look up the necessary information in the database.
Is there any web language that allows the client itself to create HTTP posts to external sites.
I know that JavaScript does this with XMLHttpRequest, but it does not allow cross-domain posting, unless the recipient domain wants to allow the sending domain.
I want to post data to an external site (that I don't control) and have the request be authenticated with what the client's browser already has (cookies, etc).
Is this possible? I tried cURL but it seems to make a server HTTP post, not a client HTTP post.
Edit:
A bit more insight of what I am trying to do:
I am trying to POST JSON to the website using the user's session (I said cookies but I believe they are PHP sessions, which I guess I still consider cookies).
The website does NOT check the referral (poor security #1)
I can execute javascript and html on the webpage using my personal homepage (poor security #2)
The JSON code will still work even if the content-type is form (poor security #3)
There is no security checking at all, just PHP session checking.
The form idea is wonderful and it works. The probably again is that its JSON. So having sent postdata as foo={"test":"123", "test2":"456"} the whole foo= part messes it up. Plus forms seem to turn JSON into form encoding, so its sending:
foo=%7B%22
test%22%3A+%22
123%22%2C+%22
test2%22%3A+%22
456%22%7D
when i need it to send;
{"test":"123", "test2":"456"}
So with everything known, is there a better chance of sending JSON or not?
I don't think so: You won't get hold of the user's auth cookies on the third party site from server side (because of the Single Origin Policy) and you can't make Ajax requests to the third party site.
The best you can do is probably create a <form> (maybe in an <iframe>), point it to the third party site, populate it with data, and have the user submit it (or auto-submit it). You will not be able to get hold of the request results programmatically (again because of the Single Origin Policy), but maybe it'll do - you can still show the request results to the user.
I think for obvious reasons this is not allowed. If this was allowed what would stop a malicious person from posting form data from a person's browser to any number of sites in some hidden iframe or popup window.
If this is a design of your application you need to rethink what you are trying to accomplish.
EDIT: As #Pekka was pointing out I know you can submit a form to a remote site using typical form submits. I was referring to using some client side ajax solution. Sorry for the confusion.
You should follow the way OpenID and other single-sign-on system works. How openID works is your website POSTs some token to openID service and in return gets authentication result. Refer How Does it Work? section here
Yes, you can use a special flash library that supports cross-domain calls: YUI connection manager
Added: not sure about the cookie authentication issue though...
The client cannot post to an external site directly; it's a breach of basic cross-domain security models. The exception is accessing javascript with JSONP. What you describe would require access to a user's cookies for another website, which is impossible as the browser only allows cookie access within the same domain/path.
You would need to use a server-side proxy to make cross-domain requests, but you still cannot access external cookies: http://jquery-howto.blogspot.com/2009/04/cross-domain-ajax-querying-with-jquery.html