You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by Vjeran Marcinko <vj...@tis.hr> on 2004/05/11 15:46:59 UTC
New Wishlist feature [WAS: Re: Invalidating a session (log out)]
I tried, and no good also.
It works in VLib example because Home page isn't secured page.
I have quite common case I think :
- *whole* application is secured, that means even Home page has
pageValidate() method implemented in such way that it redirects to Login
page if Visit doesn't contain user specific data (user isn't logged in)
I was going to implement my logOut() method straightforwardly :
public void logOut(IrequestCycle cycle) {
cycle.getRequestContext().getSession().invalidate(); // erasing visit
cycle.activate("Home");
}
,thus hoping that pageValidate() method in Home page will notice that visit
(newly created, last one has been erased) doesn't contain user data and
redirect to Login as usual, but it can't. If tried with Engine's
cleanupAfterRequest(), it invalidates session at the end of requrest, and
not before pageValidate() thus I get Home page rendered, and not redirected
to Login.
I searched the archives of Tapestry's mailing list, and people have found
some awkward ways to handle their case. I already found some for me, but
it's also awkward. I guess it's because Tapestry is quite tied with
HttpSession instance that invalidating it in the middle of request causes
various consequences depending upon application.
Maybe I'll put this to wiki's wishlist to point Howard about this problem. I
always find overriding Engine, or some other core class something more as a
hack, than typical way to achieve something. Something like
IEngine.invalidateSession() or at least IEngine.forgetAllPages() would be
great.
-Vjeran
----- Original Message -----
From: "Joerg Latteier" <la...@online.de>
To: "'Tapestry users'" <ta...@jakarta.apache.org>
Sent: Tuesday, May 11, 2004 1:10 PM
Subject: RE: Invalidating a session (log out)
> I used the code from the Vlib example and it works perfect.
> In your logout method you need to set some flag (e.g. _killSession)
> and do the actual invalidate in the
>
> cleanupAfterRequest(IRequestCycle cycle)
>
> method. For exact code see
> ..examples\Vlib\src\org\apache\tapestry\vlib\VirtualLibraryEngine.java
>
> joerg
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
Re: J2EE security? [was: Re: New Wishlist feature [WAS: Re: Invalidating a session (log out)]]
Posted by Erik Hatcher <er...@ehatchersolutions.com>.
On May 11, 2004, at 6:08 PM, Richard Lewis-Shell wrote:
> Hi Erik,
>
> Are you able to share any more details on how you use J2EE security
> with
> Tapestry?
Sure. Here's the heart of it, web.xml:
<?xml version="1.0"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web
Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>WordNet</display-name>
<filter>
<filter-name>redirect</filter-name>
<filter-class>org.apache.tapestry.RedirectFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>redirect</filter-name>
<url-pattern>/</url-pattern>
</filter-mapping>
<servlet>
<servlet-name>WordNet</servlet-name>
<servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
<load-on-startup>0</load-on-startup>
</servlet>
<servlet>
<servlet-name>login</servlet-name>
<servlet-class>org.apache.tapestry.ApplicationServlet</servlet-class>
<load-on-startup>0</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>WordNet</servlet-name>
<url-pattern>/app</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>login</servlet-name>
<url-pattern>/login</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>120</session-timeout>
</session-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>Secured</web-resource-name>
<description></description>
<url-pattern>/app/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<description></description>
<role-name>tomcat</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login</form-login-page>
<form-error-page>/login</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>tomcat</role-name>
</security-role>
</web-app>
So I have a login.application and WordNet.application.
login.application is this:
<?xml version="1.0"?>
<!DOCTYPE application PUBLIC
"-//Apache Software Foundation//Tapestry Specification 3.0//EN"
"http://jakarta.apache.org/tapestry/dtd/Tapestry_3_0.dtd">
<application name="Login">
<page name="Home" specification-path="Login.page"/>
<library id="contrib"
specification-path="/org/apache/tapestry/contrib/Contrib.library"/>
</application>
And WordNet.application has nothing special in it for security. That's
it, really. And then, of course, you can add the logout piece that
folks have posted recently.
Erik
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
J2EE security? [was: Re: New Wishlist feature [WAS: Re: Invalidating a session (log out)]]
Posted by Richard Lewis-Shell <rl...@mac.com>.
Hi Erik,
Are you able to share any more details on how you use J2EE security with
Tapestry?
Richard
----- Original Message -----
From: "Erik Hatcher" <er...@ehatchersolutions.com>
To: "Tapestry users" <ta...@jakarta.apache.org>
Sent: Wednesday, May 12, 2004 2:05 AM
Subject: Re: New Wishlist feature [WAS: Re: Invalidating a session (log
out)]
> On May 11, 2004, at 9:46 AM, Vjeran Marcinko wrote:
> > I tried, and no good also.
> > It works in VLib example because Home page isn't secured page.
> > I have quite common case I think :
> > - *whole* application is secured, that means even Home page has
> > pageValidate() method implemented in such way that it redirects to
> > Login
> > page if Visit doesn't contain user specific data (user isn't logged in)
>
>
> Securing the *whole* application is not possible, unless your login
> page is unsecured.
>
> We 'hack' around this by having an unsecured login.application (again,
> J2EE security at work here), and then the real .application. So we
> have two Tapestry servlet mappings in web.xml (Spindle doesn't like
> this - but it is perfectly legal), one is secured to a particular role.
>
> Erik
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
Re: New Wishlist feature [WAS: Re: Invalidating a session (log out)]
Posted by Erik Hatcher <er...@ehatchersolutions.com>.
On May 11, 2004, at 9:46 AM, Vjeran Marcinko wrote:
> I tried, and no good also.
> It works in VLib example because Home page isn't secured page.
> I have quite common case I think :
> - *whole* application is secured, that means even Home page has
> pageValidate() method implemented in such way that it redirects to
> Login
> page if Visit doesn't contain user specific data (user isn't logged in)
Securing the *whole* application is not possible, unless your login
page is unsecured.
We 'hack' around this by having an unsecured login.application (again,
J2EE security at work here), and then the real .application. So we
have two Tapestry servlet mappings in web.xml (Spindle doesn't like
this - but it is perfectly legal), one is secured to a particular role.
Erik
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
RE: New Wishlist feature [WAS: Re: Invalidating a session (log out)]
Posted by Petter Måhlén <pe...@elevance.se>.
> Bummer, it doesn't work in my case again. At the end, I try
> to redirect to
> Home page, which would figure out in it's pageValidate() that
> Visit doesn't
> contain necessary user data and redirect to Login, as happens
> normally when
> I start the application. But with the code above I get :
> Error 404
> The requested resource (/mywebapp/Home) is not available.
I guess that it's because a full URL (specifically, one containing the
string "://") is required to make the engine do an external redirect. The
external redirect means that the browser will issue a new request, starting
the request cycle with fresh data. I use the following code to initialise
the urlBase that is returned by my Global (WebApplication) object:
StringBuffer urlBase = new StringBuffer();
urlBase.append(context.getScheme());
urlBase.append("://");
urlBase.append(context.getServerName());
urlBase.append(":");
urlBase.append(context.getServerPort());
urlBase.append(servletPath);
m_urlBase = urlBase.toString();
The 'context' variable is the org.apache.tapestry.request.RequestContext of
the request that causes the call to createGlobal(). The 'servletPath'
variable is what is returned from the engine's getServletPath() method. A
drawback with this solution is that it is possible to have more than one
server name that a particular application responds to, and this will always
select the one used in the first request. An option is of course to use a
configuration parameter.
While I think this is not a too difficult solution, I would agree that it
would be nice with some method that allows the user to invalidate the
session and redirect the user to some specified URL with just one call.
/ Petter
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
Re: New Wishlist feature [WAS: Re: Invalidating a session (log out)]
Posted by Vjeran Marcinko <vj...@tis.hr>.
----- Original Message -----
From: "Petter Måhlén" <pe...@elevance.se>
To: "'Tapestry users'" <ta...@jakarta.apache.org>
Sent: Tuesday, May 11, 2004 11:50 PM
Subject: RE: New Wishlist feature [WAS: Re: Invalidating a session (log
out)]
> Hi,
>
> I am using the following logout method, which works in my application at
> least. It may be unnecessary to set the visit to null, since that should
> come from the invalidation of the session, I guess.
>
> HTH,
>
> Petter
>
> /**
> * log out the currently logged in user.
> *
> * @param cycle an <code>IRequestCycle</code> value
> */
> public void logoutUser(IRequestCycle cycle) {
> Visit visit = getVisit();
>
> getPage().getEngine().setVisit(null);
>
> try {
> HttpSession session =
> cycle.getRequestContext().getSession();
> if (session != null) {
> session.invalidate();
> }
> } catch (IllegalStateException ex) { }
>
> // have to throw a redirectexception to get rid of partially processed
> stuff -
> // otherwise, I get an IllegalStateException later.
> WebApplication wa = (WebApplication) getPage().getGlobal();
>
> throw new RedirectException(wa.getUrlBase());
> }
Bummer, it doesn't work in my case again. At the end, I try to redirect to
Home page, which would figure out in it's pageValidate() that Visit doesn't
contain necessary user data and redirect to Login, as happens normally when
I start the application. But with the code above I get :
Error 404
The requested resource (/mywebapp/Home) is not available.
Thanx anyway,
Vjeran
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
RE: New Wishlist feature [WAS: Re: Invalidating a session (log out)]
Posted by Petter Måhlén <pe...@elevance.se>.
Hi,
I am using the following logout method, which works in my application at
least. It may be unnecessary to set the visit to null, since that should
come from the invalidation of the session, I guess.
HTH,
Petter
/**
* log out the currently logged in user.
*
* @param cycle an <code>IRequestCycle</code> value
*/
public void logoutUser(IRequestCycle cycle) {
Visit visit = getVisit();
getPage().getEngine().setVisit(null);
try {
HttpSession session =
cycle.getRequestContext().getSession();
if (session != null) {
session.invalidate();
}
} catch (IllegalStateException ex) { }
// have to throw a redirectexception to get rid of partially processed
stuff -
// otherwise, I get an IllegalStateException later.
WebApplication wa = (WebApplication) getPage().getGlobal();
throw new RedirectException(wa.getUrlBase());
}
> -----Original Message-----
> From: Vjeran Marcinko [mailto:vjeran@tis.hr]
> Sent: den 11 maj 2004 15:47
> To: Tapestry users
> Subject: New Wishlist feature [WAS: Re: Invalidating a
> session (log out)]
>
>
> I tried, and no good also.
> It works in VLib example because Home page isn't secured page.
> I have quite common case I think :
> - *whole* application is secured, that means even Home page has
> pageValidate() method implemented in such way that it
> redirects to Login
> page if Visit doesn't contain user specific data (user isn't
> logged in)
>
> I was going to implement my logOut() method straightforwardly :
>
> public void logOut(IrequestCycle cycle) {
> cycle.getRequestContext().getSession().invalidate(); //
> erasing visit
> cycle.activate("Home");
> }
> ,thus hoping that pageValidate() method in Home page will
> notice that visit
> (newly created, last one has been erased) doesn't contain
> user data and
> redirect to Login as usual, but it can't. If tried with Engine's
> cleanupAfterRequest(), it invalidates session at the end of
> requrest, and
> not before pageValidate() thus I get Home page rendered, and
> not redirected
> to Login.
>
> I searched the archives of Tapestry's mailing list, and
> people have found
> some awkward ways to handle their case. I already found some
> for me, but
> it's also awkward. I guess it's because Tapestry is quite tied with
> HttpSession instance that invalidating it in the middle of
> request causes
> various consequences depending upon application.
>
> Maybe I'll put this to wiki's wishlist to point Howard about
> this problem. I
> always find overriding Engine, or some other core class
> something more as a
> hack, than typical way to achieve something. Something like
> IEngine.invalidateSession() or at least
> IEngine.forgetAllPages() would be
> great.
>
> -Vjeran
>
> ----- Original Message -----
> From: "Joerg Latteier" <la...@online.de>
> To: "'Tapestry users'" <ta...@jakarta.apache.org>
> Sent: Tuesday, May 11, 2004 1:10 PM
> Subject: RE: Invalidating a session (log out)
>
>
> > I used the code from the Vlib example and it works perfect.
> > In your logout method you need to set some flag (e.g. _killSession)
> > and do the actual invalidate in the
> >
> > cleanupAfterRequest(IRequestCycle cycle)
> >
> > method. For exact code see
> >
> ..examples\Vlib\src\org\apache\tapestry\vlib\VirtualLibraryEngine.java
> >
> > joerg
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tapestry-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tapestry-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tapestry-user-help@jakarta.apache.org