CODEWITHSUNDEEP
javasecurityhttpcookies
dvanaria
dvanaria

Reputation: 6783

Java Web App Security using Cookies

I'm finishing a Cattle Drive assignment where a small Java web application manages a movie library for the client. The assignment is to put some security on the application using cookies, so that a "hacker" couldn't just guess one of the URLs that would lead to another part of the application. The user will be directed to login to the site and not be allowed to view other pages until logged in.

The parts of the web app are:

1. index.html
2. VideoServlet
3. listvideos.jsp
4. addvideo.jsp
5. videologin,jsp

The entry point is request URL http://localhost:8080/videos, which loads the index.html file. This page just has a link which redirects the user to the VideoServlet. From there, the servlet forwards the HTTP request and response to listvideos.jsp, which has a link to add videos if the users wants to do that.

I'm having trouble understanding how to implement the security using cookies, while keeping everything in the MVC2 pattern (the servlet is the controller, the jsp's are the view).

Here is the program flow I came up with, but I think I'm missing the point somewhere:

  1. user enters URL http://localhost:8080/videos, which pulls the index.html file by default.

  2. the index.html file basically sends an HTTP Get to VideoServlet. The servlet somehow knows the user isn't logged in yet, so forwards the request/response to the videologin.jsp.

  3. a login is presented and asks the user for a password (this is a standard html form). The user enters the password and clicks submit. This sends an HTTP Post to the servlet.

  4. the servlet checks the password and if correct, the user is logged in and the servlet forwards to listvideos.jsp.

I don't get where cookies come in or how they can help prevent a hacker from guessing a URL and gaining direct access to, for example, addvideos.jsp. Is a cookie being used to verify if the user has already logged in?

Upvotes: 1

Views: 3390

Answers (2)

Yohan Liyanage
Yohan Liyanage

Reputation: 7000

Cookies are some plain text values (stored in text files in browser cache normally) that you could use to store data on client side. When the user makes a request to a particular URL, all cookies stored on that server (domain) are passed with it, so that the server can read up those values.

In Java, you can set a cookie like this in your servlet (in your case, when user logs in, create a cookie and store a value in it (ex. username=josh). You could do this in your login servlet after a successful login.

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

    // Verify login, and get the username. Assume it's josh

    Cookie cookie = new Cookie("username", "josh");
    cookie.setMaxAge(60*60*24); // 24 hours for expiry
    response.addCookie(cookie);

}

Later on, you can check for the existence of the cookie and if it exists, then the user has logged in. If not, you can send a redirect to the login page.

You can check for cookies like this in your servlet. 

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

    Cookie[] cookies = request.getCookies();

    String username = null;

    for (Cookie c : cookies) {
        if ("_username".equals(c.getName())) {
            username = c.getValue();
            break;
        }
    }

    if (username == null) {
        // Not Logged in. Redirect to Login
    }

    // User Logged In. Proceed
}

Instead of putting this code in all your Servlets + JSPs, you can easily put this into a Servlet Filter class. You can read up on more on that here: http://javaboutique.internet.com/tutorials/Servlet_Filters/

Ideally, you could provide a Logout feature also, which will remove the value assigned to the username cookie by replacing it with null.

I showed the above example because you mentioned that you need to use cookies for your assignment. But if you can, try to use the Sessions (which in turn uses cookies most of the time) to store logged in user details. With sessions, you can use session timeouts to ensure that idle users will be automatically logged off after a while and so on.

Upvotes: 3

sarnold
sarnold

Reputation: 104050

the index.html file basically sends an HTTP Get to VideoServlet. The servlet somehow knows the user isn't logged in yet, so forwards the request/response to the videologin.jsp.

The somehow knows is due to looking for the presence of the cookie in the request. Make sure the contents of the cookie are protected by a message authentication code, so you can be sure that your server actually handed out the cookie. It'd also be a good idea to encode into the cookie the specific IP address being used by the client, so an attacker can't hijack a cookie. (If a client changes IP address during a session, requiring them to log in again isn't horrible. Maybe annoying, but not unexpected.)

the servlet checks the password and if correct, the user is logged in and the servlet forwards to listvideos.jsp.

the user is logged in -- set the cookie into the browser for future requests.

Upvotes: 0

Related Questions