带有tomcat身份验证的“正确”登录页面

Question

I'm trying to create a user login page for my jersey webapp on tomcat that behaves like all the other pages on the web. That is, the user sees a nice login page opposed to a popup (like BASIC tomcat authentication) and the passwords are hashed before comparing to the DB entries. Is tomcat authentication the right way to do this?

It seems that I want to use DIGEST authentication for md5 hashing but FORM authentication to get a page rather than a popup. Perhaps there are java libraries to do this instead, and I should simply not use tomcat for this.

Answer 1

查看Apache Shiro或Spring Security 。

Answer 2

When using the form submission approach, BASIC versus DIGEST does not come into play at all since it isn't using HTTP Authentication. It simply sends the user id and password via an HTTP POST as parameters to a URL that is predefined by the Servlet specification, allowing the Servlet container to process them. Security of the data using this method is achieved through the use of SSL.