Tomcat - Invalid Direct Reference To Login Page ( Workaround help )

java-programmer, Tomcat - Invalid Direct Reference To Login Page ( Workaround help ) Hi,

I'm really happy that the "Invalid Direct Reference To Login Page" has
finally been fixed. However I am stuck using Tomcat 4.0.x ( and I
cannot recompile the app-server as it is a managed resource ) , and
the requirement to have a login box included in each page via a panel
is still there.

I've been looking for a workaround. According to the FormAuthenicator
Tomcat code, if the requestURI in the request is NULL, then the
"Invalid Direct Reference To Login Page" error is thrown.

I've written a proxy servlet called LoginProxy. Its job was to alter
the requestURI in the request object before posting to the
j_security_check target.

My login form would post to something like:

LoginProxy?j_username=my&j_password=test&j_forward_uri=/index.jsp

Great, apart from one small problem - HttpServletRequest is READ ONLY.
Damn. I had a look at the actual class heirarchy, and found that
HttpServletRequestFacade was the class that implemented
HttpServletRequest for Tomcat ( I am prepared write Tomcat specific
code, as long as it doesn't involve changing Tomcat itself. ).
HttpServletRequestFacade extends HttpServletRequestImpl, which
implements HttpRequest. HttpRequest does have write access, however
the code:
( ( HttpRequest ) a_Request ).setRequestURI( sForward )
gives a ClassCastException.

My other thought, was - if I just do a sendRedirect ( I was using
forward before ), won't the requestURI be the url of the LoginConfig
servlet.... I could cope with tomcat forwarding me back to the
servlet, I'd just have to add some extra logic. Alas, the request
still retains the null indicating to requestURI.

Can someone tell me how I can modify the request object, or even
create a new one?

Thanks

Ben

java-programmer >> Tomcat - Invalid Direct Reference To Login Page ( Workaround help )
"Ben Jessel" <email***@***.com> wrote in message
news:email***@***.com...
> Hi,
>
> I'm really happy that the "Invalid Direct Reference To Login Page" has
> finally been fixed. However I am stuck using Tomcat 4.0.x ( and I
> cannot recompile the app-server as it is a managed resource ) , and
> the requirement to have a login box included in each page via a panel
> is still there.
>
> I've been looking for a workaround. According to the FormAuthenicator
> Tomcat code, if the requestURI in the request is NULL, then the
> "Invalid Direct Reference To Login Page" error is thrown.
>
> I've written a proxy servlet called LoginProxy. Its job was to alter
> the requestURI in the request object before posting to the
> j_security_check target.
>
> My login form would post to something like:
>
> LoginProxy?j_username=my&j_password=test&j_forward_uri=/index.jsp
>
> Great, apart from one small problem - HttpServletRequest is READ ONLY.
> Damn. I had a look at the actual class heirarchy, and found that
> HttpServletRequestFacade was the class that implemented
> HttpServletRequest for Tomcat ( I am prepared write Tomcat specific
> code, as long as it doesn't involve changing Tomcat itself. ).
> HttpServletRequestFacade extends HttpServletRequestImpl, which
> implements HttpRequest. HttpRequest does have write access, however
> the code:
> ( ( HttpRequest ) a_Request ).setRequestURI( sForward )
> gives a ClassCastException.
>
> My other thought, was - if I just do a sendRedirect ( I was using
> forward before ), won't the requestURI be the url of the LoginConfig
> servlet.... I could cope with tomcat forwarding me back to the
> servlet, I'd just have to add some extra logic. Alas, the request
> still retains the null indicating to requestURI.
>
> Can someone tell me how I can modify the request object, or even
> create a new one?

It looks to me like HttpServletRequestWrapper is provided for that
purpose. By extending it you can create a modified request object.

Bill

----== Posted via Newsfeed.Com - Unlimited-Uncensored-Secure Usenet News==----
http://www.newsfeed.com The #1 Newsgroup Service in the World! >100,000 Newsgroups
---= 19 East/West-Coast Specialized Servers - Total Privacy via Encryption =---