RE: Potential Security Flaw in Struts MVC

[Craig R. McClanahan]

On Tue, 8 May 2001, Manabendra Sarkar wrote:

> but if i use external security mechanism, will it be dynamic? i mean to say,
> if the admin wants to change his/her password from the application
> (using admin interface), how can he/she do that without restarting the
> server? 
> 

There is no global answer to that question, because it depends on how your
security information is looked up.

Just as an example of what's possible, consider how Tomcat 4.0 implements
container managed security.  The default mechanism is a simple XML file
that is read once when the app starts up, so any changes require an
application restart.  However, you can easily configure Tomcat to look up
users and roles in a database (via JDBC) or a directory server (via
JNDI).  In these cases, changes you make to the usernames, their
passwords, and their security roles *are* dynamically recognized, because
they are looked up every time the user logs on.

Craig McClanahan