Web Application Security Representation and Management of Data on the Web

Problem Want to restrict access to certain web pages Must answer the following questions –which pages should be restricted? –who should access restricted pages? –how should users be authenticated? Other issues (not discussed here): Encrypting data when transported

Declarative Security Use web server specific mechanisms to solve problems above Advantage: JSP and Scriptlets do not have to do anything special Disadvantage: Server specific process Disadvantage: All or nothing security, i.e., users can see page or not see it. Page content is not dependant on the user.

Programmatic Security Write code to authenticate/restrict users Advantage: Not server specific Advantage: Very flexible Disadvantage: A lot of work to program + all Servlets and JSP have to cooperate for this to work

Declarative Security: BASIC 1.Set up usernames, passwords, and roles. 2.Tell the server that you are using BASIC authentication. Designate the realm name. 3.Specify which URLs should be password protected. 4.Turn off the invoker servlet.

1. Defining Usernames, Passwords, and Roles Define users, passwords and roles in file: tomcat_home/conf/tomcat-users.xml <user name="snoopy" password="ypoons" roles="special" /> <user name="charlieb " password="beilrahc" roles="special, admin" />

2. Tell the Server to use BASIC Security Add to web.xml file in tomcat_home/webapps/appname/WEB-INF BASIC Some Name

3. Specify URLs to be Protected Add to web.xml: Sensitive /sensitive/* special

4. Disable Invoker Servlet You protect certain URLs that are associated with registered servlet or JSP names. The format of default servlet URLs will probably not match the pattern. Thus, the security restrictions are bypassed when the default URLs are used. You can disable such URLs (details omitted)

Declarative Security: FORM Instead of a dialog box, you can create a form for validating users You can also create your own error page

Add to web.xml FORM /admin/login.jsp /admin/login-error.jsp

Create Login Page … Log In Sorry, you must log in before accessing this resource. User name: Password:

Create Error Page Begone! Begone, ye unauthorized peon.

Adding Some Programmatic Security So far, all or nothing: –can see page or –can't see page Allow page content to be dependant on the authorization of the user Use method isUserInRole of HTTPServletRequest

Example Suppose that a page requires authorized access Both the employee role and the executive role can access the page Put in the page: Something regular employees should not see