You're not supposed to be able to reach the login page, except by accessing a secure page. The container is then responsible for displaying the login page and sending the user to the correct secure page, once they have been authenticated. So, rather than having a link to your login page from your home page, you should have a link to your main welcome page inside your secure area. Tomcat will then send the user to the login page automatically, if they haven't been authenticated.
What version of Tomcat are you using? Unfortunately, in TC 3.2.x (possibly others, but I'm not sure) the container *redirects* the user to the login page which makes it possible for the user to then bookmark that page -- thus defeating the idea that they have to access a secure page first. The only way I found to get around this was to put my login page in a separate "/login" directory and then put an "index.jsp" file in that directory that redirects to my secure area. That way, anyone who bookmarked the login page was handled correctly. I'm not sure if this will work in other versions of Tomcat, though. Hope this helps! --jeff ----- Original Message ----- From: "John Mikhail" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 05, 2001 5:36 PM Subject: Authentication problem...redirected to /null > Hello, > > I'm wondering if anyone can help me with an issue I'm having with my web > app. I have a web application that uses the JDBCRealm and I've defined > all the roles and what not. Here's the scenario... > > If I try to access a secure page, it will take me to the login page. I > login with a valid user and then get redirected back to the secure page > with no problems now that I'm authenticated. That's not the problem. > The problem is I can also login from the home page. If I log in from > the home page with the same authenticated user, it tomcat is trying to > redirect me to <context>/null. Why is that? I have a welcome file list > defined in my web.xml. If anyone can help, it would be greatly > appreciated.. > > > -- > John Mikhail > "Codito, Ergo Sum" > > > -- > To unsubscribe: <mailto:[EMAIL PROTECTED]> > For additional commands: <mailto:[EMAIL PROTECTED]> > Troubles with the list: <mailto:[EMAIL PROTECTED]> > -- To unsubscribe: <mailto:[EMAIL PROTECTED]> For additional commands: <mailto:[EMAIL PROTECTED]> Troubles with the list: <mailto:[EMAIL PROTECTED]>
