Secure Web Application

Key Word:
Authentication: 證實,證明(確定user的身分)
Authorization: 授權,批准(確定user的權限)
Data integrity: 防止資料在傳輸中被變更,用hash code
Confidential: 資料保密
Auditing : 紀錄log

Authentication 方法
HTTP Basic 最一般,沒加密
HTTP Digest 有加密,可是只有ie可用
HTTPS Client 用SSL加密,但需要certification
HTTP FORM-based FORM版的Basic

user的name,password,role在conf\tomcat-users.xml中定義

而authentication的方法在web.xml中定義

<login-config>
<auth-method> BASIC or FORM ... </auth-method>

  如果是BASIC
<realm-name> sales </realm-name>

  如果是FORM
<form-login-config>
 <form-login-page> /formlogin.html </form-login-page>
 <form-error-page> /formerror.html </form-error-page>
</form-login-config>

</login-config>

Declarative Security方法

<security-constraint>
<web-resource-collection>
 <web-resource-name>
   <url-pattern> /servlet/SaleReportServlet/*  </url-pattern>
   <url-pattern> /servlet/HttpReportServlet/*  </url-pattern>
   <http0-method> POST </http-method>

 </web-resource-name>

</web-resource-collection>

 待續

</security-constraint>