7

I have two applications - A Java EE web application and a Java SE applet. I want to authenticate a user in the applet by means of a JSESSIONID (which is created by the web application).

So there is a problem - how to associate this JSESSIONID with a particular user?

How to check (on the web server application side) which user is represented by such JSESSIONID? In the applet I will be reading it from a cookie, and then I want to write a simple Servlet which will accept this JSESSIONID as a POST message. Thereafter I would like to write in the response nothing at all when the JSESSIONID is bad, and the user info if JSESSIONID is good (i.e. is representing someone).

Does anyone know how to do this?

4

2 回答 2

10

JSESSIONID是您通常不应该关心的低级机制。在服务器端，servlet 容器透明地转换JSESSIONID为servlet 中HttpSession可用的对象。会话 id 也使用Cookie标头或 URL 重写透明地传递给服务器。

因此，如果您在网页中单击链接或发布普通表单，浏览器会自动传递JSESSIONIDcookie 或将其附加到 URL。

您的设计有一个重大缺陷：安全的 servlet 容器应该向cookie添加HttpOnly属性（请参阅：如何在 tomcat / java webapps 中配置 HttpOnly cookie？）这是为了防止 JavaScript 出于安全原因读取cookie - 例如劫持用户会话。您的小程序甚至可能看不到那个 cookie！JSESSIONIDJSESSIONID

我对了解不多，但我建议您以某种方式通过 Web 浏览器执行 HTTP 请求，以便自动处理安全标识（cookie）。

于 2012-05-13T07:45:01.123 回答
3

The Java EE container will do most of the work for you. There are a couple of short-cuts you can take depending on with authentication method you use and the details of how the container behaves. I'll ignore those short-cuts for now. I am assuming that the user provides their information to the web application in some form - for example by logging in.

When the user logs in, create a session (if one doe snot already exist) and add their user name (and any other details you like) to the session as session attributes.

When a request comes in that already has a session, just retrieve the user details from the session. The container takes care of mapping the session ID in the request to the right session object and making that available to the request.

If the session ID is invalid, the container will not associate a session object to the request.

One final thing to watch out for is HttpOnly cookies. Containers should be using these by default for session IDs (to protect against XSS attacks). For the session ID to be available to the applet you'll need to disable the HttpOnly protection for the session cookies. This means that if you application has an XSS vulnerability it will be easy for an attacker to steal user session cookies.

于 2012-05-13T07:50:25.943 回答