j_security check error, migrating from 3.0.3 to 3.2.5

[dlastoria]

I am trying to deploy a previously working application onto a newer JBoss installation. This application runs fine on JBoss 3.0.3 (Jetty). It deploys fine to 3.2.5 (Tomcat) and I can access the login page. However when I attempt to log in I get the following error message:

HTTP Status 400 - Invalid direct reference to form login page

--------------------------------------------------------------------------------

type Status report

message Invalid direct reference to form login page

description The request sent by the client was syntactically incorrect (Invalid direct reference to form login page).


--------------------------------------------------------------------------------

Apache Tomcat/5.0.26

I have read dozens of posts on this topic, but none of them make sense to me. I'm pretty new to JBoss, so any help is greatly appreciated!

[haobaba1]

The security mechanism does not want the user to go directly to the login page. What you need to do is make sure that the user was forwarded to the login page by the application server. I have seen people put scriptlets in the login page which check to see if the session is new and then redirect to a protected resource if it is. This will cause the servlet container to then redirect back to the login page. What I did was make my page protected and then it forwards to the login page immediately if the user is not logged in. Hope that helps.

[haobaba1]

correction: What I did was make my welcome page protected .....

[dlastoria]

Thanks for your response. The user accesses the webpage by going to the context-root, which then display the login form webpage. I enter the credentials, which it validates. Then when it is forwarding/redirecting to the appropriate page I get this error message.

I have no problems with this under JBoss 3.0.3. Under that version I was using Jetty and now it is Tomcat. Perhaps there is a setting that I am not considering.

[haobaba1]

"dlastoria" wrote:
Thanks for your response. The user accesses the webpage by going to the context-root, which then display the login form webpage. I enter the credentials, which it validates. Then when it is forwarding/redirecting to the appropriate page I get this error message.

I have no problems with this under JBoss 3.0.3. Under that version I was using Jetty and now it is Tomcat. Perhaps there is a setting that I am not considering.

is your login page index.jsp or another file that is set up as the welcom page in your web.xml. If so, then that would be the problem. You would need to have the user requesting a protected resource to trigger the authentication process.

[dlastoria]

This is very possibly the problem. I added the security page to Tomcat's web.xml. Like this:

 <welcome-file-list>
 <welcome-file>index.html</welcome-file>
 <welcome-file>index.htm</welcome-file>
 <welcome-file>index.jsp</welcome-file>
 <welcome-file>/cm/login.jsp</welcome-file>
 </welcome-file-list>

"./deploy/jbossweb-tomcat50.sar/web.xml" 933L, 38241C written

However I am still having the same problem. After it validates the credentials it gives the same error message above when trying to redirect to:

https://www.companyname.com/cm/j_security_check

[dlastoria]

Any other ideas?

[dlastoria]

This is still affecting us in production. Appreciate any and all help! Thanks!

[starksm64]

Create a bug report on sourceforge with a sample war that demonstrates the problem.

http://sourceforge.net/tracker/?group_id=22866&atid=376685

[asduarte]

I had the same problem, I solved changing the action like below:


<form action="<%=response.encodeURL("j_security_check")%>" method="POST">

Cookies was turned off...