1 Reply Latest reply on Dec 6, 2010 11:48 AM by aartir

    After jaas implementation , we see the username and password in url on incorrect login

    aartir
    aartir Aug 3, 2010 5:42 PM

      Hi,

       

      We have jboss-4.2.2GA , after implementing JAAS  , whenever a user has an incorrect login then we see the url /password like below

       

      http://localhost:8080/test/j_security_check?j_username=asdf&j_password=adf&btnLogin=Login

       

      is there any way we can stop this?

       

      I check the FormAuthenticator.class where we forward to error page

       

      RequestDispatcher disp =

      context.getServletContext().getRequestDispatcher(config.getErrorPage());

      disp.forward(request.getRequest(), response.getResponse())

       

       

      So this way request has these parameters and its shown in the url when it forwards to error page.

       

      Is there any configuration or any new version of jar .. where this issue is fixed?

       

      Quick response is appreciated , we have customers complaining on this and we need to fix it.