It depends on the container ... in WebSphere, I had to make a slight modification:
http://www.webspherepower.com/issues/issue200411/00001360001.html Mikolaj Rydzewski <[EMAIL PROTECTED]> To: 08/08/2005 03:27 [email protected] PM cc: Subject: Please respond to Insecure login form redirections? [EMAIL PROTECTED] ator.apache.org Hello, I'm a new user of roller blogger. I'm not sure if the following case is true because of my misconfiguration or design flaw in roller. While processing login form roller redirects user using get method with clear text login and password in url! The following is a capture from liveHttpHeaders firefox plugin: 1. login form submission POST /roller/auth/ [ login form data ] 2. here it goes: redirect with clear text sensitive data: HTTP/1.x 302 Moved Temporarily Location: http://server/roller/j_security_check?j_username=login&j_password=pass&j_uri= 3. the following is placed in webserver's log GET /roller/j_security_check?j_username=login&j_password=pass&j_uri= HTTP/1.1 4. HTTP/1.x 302 Moved Temporarily Location: http://server/roller/login-redirect.jsp 5. GET /roller/login-redirect.jsp HTTP/1.1 6. and finally we can blog HTTP/1.x 302 Moved Temporarily Location: http://server/roller/editor/weblog.do?method=create&rmk=tabbedmenu.weblog&rmik=tabbedmenu.weblog.newEntry Of course passwords are stored in webserver's log too. Is it my misconfiguration? My setup is rather simple, I guess. Tomcat 5.5.x is running roller webapp on host A. Site is available via apache 2.0.54 on host B, which uses mod_rewrite to proxy requests to tomcat. They're both FreeBSD 5.4, Tomcat runs on JDK 1.4.2. -- Mikolaj Rydzewski <[EMAIL PROTECTED]> http://ceti.pl/~miki/ PGP KeyID: 8b12ab02 There are three kinds of people: men, women and unix.
