Win a copy of Functional Reactive Programming this week in the Other Languages forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

Form based authentication

 
shankar valiinaykam
Greenhorn
Posts: 23
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi,

P-700; Q-1 says Form based authentication is recommended only if cookies or SSL session tracking is enabled. Why is it like this, when URL rewriting is there to save us?

In security roles, i find one combination missing. If two security constraints are there for same resource as "*" and nobody <auth-constraint/> then who rules? Is it "everybody" or "nobody"?
My guess is : Nobody. Somebody, plz confirm.

Thanks,
Shankar
 
shankar valiinaykam
Greenhorn
Posts: 23
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Oooops!!! I wanted to write P-667 and Q-9.
 
Daniel Spaethe
Greenhorn
Posts: 15
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
From my understanding, the reason they indicate that form based authentication should only be used wihen SSL session tracking is enabled is that out of the 4 types, BASIC, CLIENT-CERT, DIGEST and FORM, FORM is the least secure. The other 3 types provide at least some type of encryption.


As for your other qustion, an empty <auth-constraint/> tag will combine with anything else and will allow "nobody".

Dan
 
Daniel Spaethe
Greenhorn
Posts: 15
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Sorry, meant to say that the FORM is the least secure of all:
BASIC - is encoded, but not encrypted. base 64
DIGEST - not widley used.. but more secure than BASIC
CLIENT-CERT - clients need a certificate on their side.
FROM - least secure of all 4
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic