Reject GET method on j_security_check

Question

Is there a way to allow POST requests for j_security_check? I want to reject the GET. I use form-based security and want to allow only messages in j_security_check. If the login request is through a GET, the request must be rejected.

Answer 1

Trying to do the same on a JBOSS server (Tomcat) due to JAAS security issues using GET methods, I tried in various ways.

• Using the web.xml security restriction on the url / j_security_check template to use only POST - this does not work for the JAAS mechanism, as for regular servlets.

• , , GET, j_security_check. - .

• , POST j_security_check. , JAAS - .

• , JAAS.

:

HttpServletRequest req = (HttpServletRequest) request;
if (req.getMethod().equals("GET")) {
 log.warn("Someone is trying to use a GET method to login!!");                       
 request.getRequestDispatcher("/login.jsp").forward(req, response);
 throw new ServletException("Using a GET method on security check!");
}

.

Answer 2

, GET. web.xml http. xml , , POST. j_security post.

<security-constraint>
  <display-name>Your security constraint</display-name>
  <web-resource-collection>
     <web-resource-name>Your resource name</web-resource-name>
     <url-pattern>/The URL pattern</url-pattern>
     <http-method>POST</http-method>
  <web-resource-collection>
<security-constraint>

Answer 3

.

j_security .

, , ( , )

GET, , . , POST- myaccount ( ), , HTTP- , GET .

, POST, GET .

Answer 4

, :

• , POST, j_security_check -/loadbalancer, nginx/apache

. Apache 2.4 :

<LocationMatch ".*j_security_check">
    AllowMethods POST
</LocationMatch>

• , j_security_check , HttpServletRequest.login(...)