Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of jnss81@gmail.com designates
 74.125.78.145 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject:references
         :in-reply-to:content-type:content-transfer-encoding;
        b=NeD3wKdcXFJdQYDUx8MTKXo3YRa9f2Th0Y9AuGygm11XYY9F+H5kE4vUsTfwliMmb/
         aQbWWql93QrVwIQ3ll7tOf5fNAUm5+ZbbuVt5DiRebD/aABIeDobGiE28icjc+70h7Yc
         9VRFDErZrDpFkC3SnTAqXKI4K9QT7+RmoBVFw=
Message-ID: <4B044757.5080504@gmail.com>
Date: Wed, 18 Nov 2009 19:13:27 +0000
From: =?UTF-8?B?Sm/Do28gTnVubyBTaWx2YQ==?= <jnss81@gmail.com>
User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: POST replication
References: <4B041541.8060503@gmail.com> <4B042400.4090103@apache.org>
 <4B0433FB.4020301@christopherschultz.net> <4B043BC3.1040002@gmail.com>
 <99C8B2929B39C24493377AC7A121E21F967C73EDDA@USEA-EXCH8.na.uis.unisys.com>
In-Reply-To: 
 <99C8B2929B39C24493377AC7A121E21F967C73EDDA@USEA-EXCH8.na.uis.unisys.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Caldarale, Charles R wrote:
>> From: João Nuno Silva [mailto:jnss81@gmail.com]
>> Subject: Re: POST replication
>>
>>  From what I've seen in the FormAuthenticator class Mark pointed me to,
>> Tomcat doesn't create a new request, instead it fills it's fields with
>> the values from the previous request. I'll try this in the near future
>> and let you guys know how it went. Thanks!
>>     
>
> I'm curious as to why you're reinventing this particular wheel.  Why not let Tomcat's built-in authentication handling do the hard work for you, and you just supply either a custom Realm or a JAAS-compliant login module to do the actual user validation?  That would seem to be a lot easier and a lot less dependent on the internals of the particular Tomcat version you happen to be using.
>   
I'm doing this as an hobby, not at work! With this in mind, my reasons are:
1) I want to have an authentication module that's independent of the 
servlet container used (because I think this behavior of request replay 
isn't a standard, but I might be wrong...);
2) I believe I can better optimize session creation to reduce memory 
usage (because I won't save the previous request in session). I think 
this way I can be more tolerable to DoS attacks from unauthenticated users;
3) I'm learning a few things in the process of reinventing this wheel ;)
>  - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>
>   


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org