If internal staff could substitute LoginServlet for another servlet, then you have a
deeper security problem.
However, if you cannot control your servlet host, and depending on what your servlet
does, then it is possible to push the authorization of the user's actions back to a
system that you can control, and simply have the LoginServlet as something that
facilitates collecting the user's credentials.
If you use J2EE (ie. EJB's) or access only a single back-end DBMS, then this is quite
a decent way to go.
We do this quite successfully with our web apps.
You might also see if the 'login by form' capabilities of the Servlet 2.2 Spec suit
your needs.
thanks,
David.
> ----- Original Message -----
> From: "Carlos Otero Barros" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, January 31, 2001 9:31 AM
> Subject: Is LoginServlet bad practice?
>
>
> > Hi All!
> >
> > Recently I have been envolved in a discussion about the convenience of
> > encapsulating login process in a separate servlet. Namely LoginServlet.
> > My opinion is this is a bad practice from a security point of view.
> > Internal personel could substitute the LoginServlet with any other
> > simple servlet with the same methods() and take the whole web site
> > unsecured.
> >
> > Your opinion?
> >
> > Thanks
> >
David Bullock
LISAsoft Project Lead
Sun Certified Programmer for the Java 2 Platform
email: [EMAIL PROTECTED]
mobile: +61 4 0290 1228
"The key ingredients of success are a crystal-clear goal,
a realistic attack plan to achieve that goal,
and consistent, daily action to reach that goal."
Steve Maguire, "Debugging the Development Process".
LISAsoft
http://www.lisasoft.com/
Adelaide Sydney
-------------------- ------------------------
38 Greenhill Rd Level 3, 228 Pitt Street
Wayville S.A. 5034 Sydney NSW 2000
Australia Australia
PH +61 8 8272 1555 PH +61 2 9283 0877
FAX +61 8 8271 1199 FAX +61 2 9283 0866
-------------------- ------------------------
===========================================================================
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff EJB-INTEREST". For general help, send email to
[EMAIL PROTECTED] and include in the body of the message "help".
