1

Currently, we are thinking to add a login module for our website (which previously can be used by all, no need to login). I think that we need to have a user table to store id and password, a password cryptography API to encrypt the password then store into the table. A server side validation to validate if the id/password is match. And code to maintain the login information in the session (which is the difficult part I think).

I don't have experience before in implementing the server side login module. So I wonder if there is some third party library or API that can be used to ease the implementation. I am using tomcat as the web server, so Java libraries are preferred.

Or if someone have experience in implementing it, could you give me some advice.

Thank you all.

ausgoo
  • 247
  • 1
  • 10

3 Answers3

1

I think you are looking for a Security Framework.

A Security Framework is a comprehensive solution to authentication, authorization and session management.

Take a look into Shiro vs. Spring Security.

Personally, I feel that Apache Shiro is simpler to use. Here's a simple tutorial.

Community
  • 1
  • 1
nunaxe
  • 1,432
  • 2
  • 15
  • 16
1

You should be looking first and foremost at Container Managed Authentication. It's all done for you, you just have to fit into the rules.

And you must hash the password, not encrypt it, otherwise you lose all sorts of desirable security properties, including most importantly non-repudiation, which has major legal consequences.

user207421
  • 305,947
  • 44
  • 307
  • 483
0

Suprised to see that Shiro engages the Dont Control Flow with Exceptions antipattern.

Another option is Seam. It provides much of this functionality with dependency injection.

Rob
  • 11,446
  • 7
  • 39
  • 57
  • Can you share references where Shiro uses this. I was planning to use it. – Jus12 Aug 29 '13 at 18:24
  • If you click through on the link to Shiro 2 answers up, then click on their Tutorial, you will see that they have a try/catch construct for finding out why someone's authentication failed. – Rob Aug 29 '13 at 23:32