You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Dave <ja...@yahoo.com> on 2006/03/02 18:02:24 UTC
Form login UTF-8 username problem
Web application using JBoss 4.0.3SP1 and servlets.
I am using FORM authentication. Can username be UTF-8?
I create an account, its username is in UTF-8 encoding, chinese characters.
But login was not successful. Can JBoss built-in authentication handle UTF-8 encoding for username?
Ascii username works.
I tried to use a filter to set request encoding to UTF-8, but the filter was not called for URL pattern "j_security_check".
<filter-mapping>
<filter-name>filter</filter-name>
<url-pattern>/j_security_check</url-pattern>
</filter-mapping>
Right now I am using a filter to set request encoding to UTF-8 for all requests in order to support chinese characters. It works great except Form login. The username is created in UTF-8 and stored in database.
The related part in login-config.xml
<login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
flag="required">
<module-option name="dsJndiName">java:/DefaultDS</module-option>
<module-option name="principalsQuery">
select password from User where username=?
</module-option>
So I suspect the FORM login need to go through a filter to set its encoding to UTF-8. Otherwise, the server side would assume iso-8859-1 encoding, and it would not find the username in database table. Is there a way to tell Web Container about the request encoding?
Thanks for help. Have a nice day!
---------------------------------
Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.
Re: Form login UTF-8 username problem
Posted by Martin Gainty <mg...@hotmail.com>.
Good Morning Dave-
The earlier comment about using DBCS UTF-16 holds true for CJK,
Hebrew,Arabic or any character set using 2 or more bytes to represent a
'character'
I think what daniel is alluding to in this response is the ability for
others to mask certain characters
It sounds as if you might want to look at ssl..
using private/public keys or certificates
http://java.sun.com/j2ee/1.4/docs/tutorial/doc/Security6.html
This will enable
Authentication - verifying client credentials
Confidentiality - Avoiding man in the middle interception
Integrity - Avoiding man in the middle modfication to the transmission
Keep us apprised,
Martin-
----- Original Message -----
From: "Dave" <ja...@yahoo.com>
To: "Tomcat Users List" <us...@tomcat.apache.org>; <da...@wordchamp.com>
Sent: Sunday, March 05, 2006 10:09 PM
Subject: RE: Form login UTF-8 username problem
> Hi Daniel,
>
> I am not quite understanding. Is it a security hole?
> User needs a username and password to login to the web application.
>
> Thanks!
> Daniel Blumenthal <da...@wordchamp.com> wrote:
> As a security concern, you might not want to allow full UTF-8 usernames.
> There are a number of invisible characters (from the soft hyphen to
> various
> connector characters) which people can use to spoof other users' names.
>
> Daniel
>
>
>> -----Original Message-----
>> From: Mark Thomas [mailto:markt@apache.org]
>> Sent: Friday, March 03, 2006 1:50 PM
>> To: Tomcat Users List
>> Subject: Re: Form login UTF-8 username problem
>>
>> Dave wrote:
>> > Web application using JBoss 4.0.3SP1 and servlets.
>> > I am using FORM authentication. Can username be UTF-8?
>> > I create an account, its username is in UTF-8 encoding,
>> chinese characters.
>> > But login was not successful. Can JBoss built-in
>> authentication handle UTF-8 encoding for username?
>>
>> This looks like
>> http://issues.apache.org/bugzilla/show_bug.cgi?id=31198
>>
>> It is fixed in 5.5.7+
>>
>> Mark
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
>
>
> ---------------------------------
> Yahoo! Mail
> Bring photos to life! New PhotoMail makes sharing a breeze.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Form login UTF-8 username problem
Posted by Eric Haszlakiewicz <er...@swapsimple.com>.
>> Daniel Blumenthal <da...@wordchamp.com> wrote:
>> As a security concern, you might not want to allow full UTF-8 usernames.
>> There are a number of invisible characters (from the soft hyphen to various
>> connector characters) which people can use to spoof other users' names.
On Sun, Mar 05, 2006 at 07:09:52PM -0800, Dave wrote:
> Hi Daniel,
>
> I am not quite understanding. Is it a security hole?
> User needs a username and password to login to the web application.
It _can_ be a security hole, but it does not necessarily _have_ to be
one. It certainly can make things a bit trickier to get right.
The problem is that two usernames that are actually different can
_look_ the same. For example, say you are looking at two usernames, both
of which appear on your screen as "joe-bob". It is possible that one of
them uses an actual ascii hyphen character, while the other uses the
unicode soft-hyphen.
This can lead to all sorts of problems. e.g. let's say "joe-bob" (the
soft-hyphen one) send you a message through your web-app (thus supposedly
proving he is authorized to ask) asking you to cancel his account.
You go and type "joe-bob" (with an ascii hyphen) into your delete-a-user
form and end up deleting the wrong user.
eric
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Form login UTF-8 username problem
Posted by Dave <ja...@yahoo.com>.
Hi Daniel,
I am not quite understanding. Is it a security hole?
User needs a username and password to login to the web application.
Thanks!
Daniel Blumenthal <da...@wordchamp.com> wrote:
As a security concern, you might not want to allow full UTF-8 usernames.
There are a number of invisible characters (from the soft hyphen to various
connector characters) which people can use to spoof other users' names.
Daniel
> -----Original Message-----
> From: Mark Thomas [mailto:markt@apache.org]
> Sent: Friday, March 03, 2006 1:50 PM
> To: Tomcat Users List
> Subject: Re: Form login UTF-8 username problem
>
> Dave wrote:
> > Web application using JBoss 4.0.3SP1 and servlets.
> > I am using FORM authentication. Can username be UTF-8?
> > I create an account, its username is in UTF-8 encoding,
> chinese characters.
> > But login was not successful. Can JBoss built-in
> authentication handle UTF-8 encoding for username?
>
> This looks like
> http://issues.apache.org/bugzilla/show_bug.cgi?id=31198
>
> It is fixed in 5.5.7+
>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------
Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.
RE: Form login UTF-8 username problem
Posted by Daniel Blumenthal <da...@wordchamp.com>.
As a security concern, you might not want to allow full UTF-8 usernames.
There are a number of invisible characters (from the soft hyphen to various
connector characters) which people can use to spoof other users' names.
Daniel
> -----Original Message-----
> From: Mark Thomas [mailto:markt@apache.org]
> Sent: Friday, March 03, 2006 1:50 PM
> To: Tomcat Users List
> Subject: Re: Form login UTF-8 username problem
>
> Dave wrote:
> > Web application using JBoss 4.0.3SP1 and servlets.
> > I am using FORM authentication. Can username be UTF-8?
> > I create an account, its username is in UTF-8 encoding,
> chinese characters.
> > But login was not successful. Can JBoss built-in
> authentication handle UTF-8 encoding for username?
>
> This looks like
> http://issues.apache.org/bugzilla/show_bug.cgi?id=31198
>
> It is fixed in 5.5.7+
>
> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Form login UTF-8 username problem
Posted by Mark Thomas <ma...@apache.org>.
Dave wrote:
> Web application using JBoss 4.0.3SP1 and servlets.
> I am using FORM authentication. Can username be UTF-8?
> I create an account, its username is in UTF-8 encoding, chinese characters.
> But login was not successful. Can JBoss built-in authentication handle UTF-8 encoding for username?
This looks like http://issues.apache.org/bugzilla/show_bug.cgi?id=31198
It is fixed in 5.5.7+
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Form login UTF-8 username problem
Posted by Martin Gainty <mg...@hotmail.com>.
Good Morning Dave-
As more applications become localised which actually means 'internationalised'
we will have to pay attention to character sets supporting DBCS character-sets
Please keep me apprised,
Martin-
----- Original Message -----
From: "Dave" <ja...@yahoo.com>
To: "Tomcat Users List" <us...@tomcat.apache.org>; "Martin Gainty" <mg...@hotmail.com>
Sent: Thursday, March 02, 2006 2:16 PM
Subject: Re: Form login UTF-8 username problem
> Hi Martin,
>
> Thanks!
> I already have the following at the beginning of all the jsp pages.
>
> <%@ page contentType="text/html; charset=UTF-8"%>
>
>
>
> Martin Gainty <mg...@hotmail.com> wrote:
> Dave-
>
> I believe you can effect this encoding if you specify encoding="UTF-8" in the xml element e.g.
>
>
> I am not aware of CJK implementations that use UTF-8 ..you may want to consider UTF-16
> Scott does this look ok?
> HTH,
> Martin-
> ----- Original Message -----
> From: "Dave"
> To:
> Sent: Thursday, March 02, 2006 12:02 PM
> Subject: Form login UTF-8 username problem
>
>
>> Web application using JBoss 4.0.3SP1 and servlets.
>> I am using FORM authentication. Can username be UTF-8?
>> I create an account, its username is in UTF-8 encoding, chinese characters.
>> But login was not successful. Can JBoss built-in authentication handle UTF-8 encoding for username?
>>
>> Ascii username works.
>>
>> I tried to use a filter to set request encoding to UTF-8, but the filter was not called for URL pattern "j_security_check".
>>
>>
>> filter
>> /j_security_check
>>
>>
>>
>> Right now I am using a filter to set request encoding to UTF-8 for all requests in order to support chinese characters. It works great except Form login. The username is created in UTF-8 and stored in database.
>>
>> The related part in login-config.xml
>>
>> > flag="required">
>>
>> java:/DefaultDS
>>
>> select password from User where username=?
>>
>>
>> So I suspect the FORM login need to go through a filter to set its encoding to UTF-8. Otherwise, the server side would assume iso-8859-1 encoding, and it would not find the username in database table. Is there a way to tell Web Container about the request encoding?
>>
>> Thanks for help. Have a nice day!
>>
>>
>> ---------------------------------
>> Yahoo! Mail
>> Bring photos to life! New PhotoMail makes sharing a breeze.
>
>
> ---------------------------------
> Yahoo! Mail
> Bring photos to life! New PhotoMail makes sharing a breeze.
Re: Form login UTF-8 username problem
Posted by Dave <ja...@yahoo.com>.
Hi Martin,
Thanks!
I already have the following at the beginning of all the jsp pages.
<%@ page contentType="text/html; charset=UTF-8"%>
Martin Gainty <mg...@hotmail.com> wrote:
Dave-
I believe you can effect this encoding if you specify encoding="UTF-8" in the xml element e.g.
I am not aware of CJK implementations that use UTF-8 ..you may want to consider UTF-16
Scott does this look ok?
HTH,
Martin-
----- Original Message -----
From: "Dave"
To:
Sent: Thursday, March 02, 2006 12:02 PM
Subject: Form login UTF-8 username problem
> Web application using JBoss 4.0.3SP1 and servlets.
> I am using FORM authentication. Can username be UTF-8?
> I create an account, its username is in UTF-8 encoding, chinese characters.
> But login was not successful. Can JBoss built-in authentication handle UTF-8 encoding for username?
>
> Ascii username works.
>
> I tried to use a filter to set request encoding to UTF-8, but the filter was not called for URL pattern "j_security_check".
>
>
> filter
> /j_security_check
>
>
>
> Right now I am using a filter to set request encoding to UTF-8 for all requests in order to support chinese characters. It works great except Form login. The username is created in UTF-8 and stored in database.
>
> The related part in login-config.xml
>
> > flag="required">
>
> java:/DefaultDS
>
> select password from User where username=?
>
>
> So I suspect the FORM login need to go through a filter to set its encoding to UTF-8. Otherwise, the server side would assume iso-8859-1 encoding, and it would not find the username in database table. Is there a way to tell Web Container about the request encoding?
>
> Thanks for help. Have a nice day!
>
>
> ---------------------------------
> Yahoo! Mail
> Bring photos to life! New PhotoMail makes sharing a breeze.
---------------------------------
Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.
Re: Form login UTF-8 username problem
Posted by Martin Gainty <mg...@hotmail.com>.
Dave-
I believe you can effect this encoding if you specify encoding="UTF-8" in the xml element e.g.
<?xml version="1.0" encoding="UTF-8"?>
I am not aware of CJK implementations that use UTF-8 ..you may want to consider UTF-16
Scott does this look ok?
HTH,
Martin-
----- Original Message -----
From: "Dave" <ja...@yahoo.com>
To: <us...@tomcat.apache.org>
Sent: Thursday, March 02, 2006 12:02 PM
Subject: Form login UTF-8 username problem
> Web application using JBoss 4.0.3SP1 and servlets.
> I am using FORM authentication. Can username be UTF-8?
> I create an account, its username is in UTF-8 encoding, chinese characters.
> But login was not successful. Can JBoss built-in authentication handle UTF-8 encoding for username?
>
> Ascii username works.
>
> I tried to use a filter to set request encoding to UTF-8, but the filter was not called for URL pattern "j_security_check".
>
> <filter-mapping>
> <filter-name>filter</filter-name>
> <url-pattern>/j_security_check</url-pattern>
> </filter-mapping>
>
>
> Right now I am using a filter to set request encoding to UTF-8 for all requests in order to support chinese characters. It works great except Form login. The username is created in UTF-8 and stored in database.
>
> The related part in login-config.xml
>
> <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
> flag="required">
>
> <module-option name="dsJndiName">java:/DefaultDS</module-option>
> <module-option name="principalsQuery">
> select password from User where username=?
> </module-option>
>
> So I suspect the FORM login need to go through a filter to set its encoding to UTF-8. Otherwise, the server side would assume iso-8859-1 encoding, and it would not find the username in database table. Is there a way to tell Web Container about the request encoding?
>
> Thanks for help. Have a nice day!
>
>
> ---------------------------------
> Yahoo! Mail
> Bring photos to life! New PhotoMail makes sharing a breeze.