Win a copy of Functional Reactive Programming this week in the Other Languages forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

Which authentication method to choose ?

 
Sreedevi Vinod
Ranch Hand
Posts: 117
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I have been reading about the different authentication types - form, basic, digest and client-cert and I have a basic doubt. It says that form and basic methods are not secure. Digest method is not supported by all containers. Client-cert is the only one left, but it requires client side certificates.
Suppose I want an aunthentication method which is secure, but I don't want to go into the hassle of client side certificates etc. then which one would I choose ? For example, my bank uses JSPs in their online banking system. It is secure (encrypted etc), but no cient side certificates or anything is used. How would they be managing that ? Same way for all these e-mail sites, where security is very important.

Please do send in your valuable insights on this.

Thanks
Devi
 
Sebastien Col
Greenhorn
Posts: 13
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi,
you can secure the FORM method using a protected transport layer connection. Most containers use HTTPS over SSL to implement this layer.

You can tell the container that you want confidentiality an d integrity by adding the <user-data-constraint> tag to the apprapriate <security-constraint>.

For example :
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>

Sebastien
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic