Re: Session authentication - Struts or ServletFilter

2004-10-07 Thread Sean Schofield
You cannot map 100% of your web application (as it seems your are doing) to the filter, because the login page you are redirecting to would itself require login. Also, your 404 mentions /do/processLogin but your filter is redirecting to /login.jsp. I'm a bit confused by that. Maybe if you co

Re: Session authentication - Struts or ServletFilter

2004-10-07 Thread Sandro Duarte
Try this: if (null == user) { session.invalidate(); res.sendRedirect("/login.jsp"); } else { chain.doFilter(request, response); } I was having some trouble with my auth filter until I realized this problem: you should continue de filter chain only if everything is ok. Sandro On Thu, 07 Oct

Re: Session authentication - Struts or ServletFilter

2004-10-07 Thread Jacob Weber
I've been doing the same thing by extending RequestProcessor (or TilesRequestProcessor). The advantage of that is, depending on which method you extend, you can have access to the Struts Form and ActionMapping objects. Jacob In article <[EMAIL PROTECTED]>, "andy wix" <[EMAIL PROTECTED]> wrot

Re: Session authentication - Struts or ServletFilter

2004-10-07 Thread andy wix
Hi, That source forge Security Filter stuff looks pretty good, but I only have a basic requirement (nothing so posh as realms). I can't seem to get my (very basic) filter to work with Struts though. I have the following in my doFilter method: HttpServletRequest req = (HttpServletRequest) request;

Re: Session authentication - Struts or ServletFilter

2004-10-06 Thread Bill Siggelkow
I second that emotion -- SecurityFilter can be described in one word ... SWEET ! Don Brown wrote: Personally, I favor a filter approach, specifically SecurityFilter - http://securityfilter.sourceforge.net/ It's configuration format follows Container-Managed Security, but is much more flexible. D

Re: Session authentication - Struts or ServletFilter

2004-10-06 Thread Don Brown
Personally, I favor a filter approach, specifically SecurityFilter - http://securityfilter.sourceforge.net/ It's configuration format follows Container-Managed Security, but is much more flexible. Don On Wed, 06 Oct 2004 13:19:59 -0400, Bill Siggelkow <[EMAIL PROTECTED]> wrote: > Well, I am not

Re: Session authentication - Struts or ServletFilter

2004-10-06 Thread Bill Siggelkow
Well, I am not sure exactly what 'Filters should not rely on session state' means; but I would use a filter -- IMO its the best way to apply across-the-board behavior w/o using container-managed security. -Bill Siggelkow andy wix wrote: Hi, What is the best approach for the above? I don't use c