Use this topic to allow migration in an application that uses form-based login and servlet filters without the use of the CustomLoginServlet class.
If login and error pages are not enough to implement the CustomLoginServlet class, use servlet filters. Servlet filters can dynamically intercept requests and responses to transform or use the information that is contained in the requests or responses. One or more servlet filters attach to a servlet or a group of servlets. Servlet filters also can attach to JavaServer Pages (JSP) files and HTML pages. All the attached servlet filters are called before invoking the servlet.
Both form-based login and servlet filters are supported by any Servlet 2.3 specification-compliant web container. A form login servlet performs the authentication and servlet filters can perform additional authentication, auditing, or logging tasks.
To perform pre-login and post-login actions using servlet filters, configure these servlet filters for either form login page or for /j_security_check URL. The j_security_check is posted by the form login page with the j_username parameter that contains the user name and the j_password parameter that contains the password. A servlet filter can use user name and password information to perform more authentication or meet other special needs.
In this information ... | IBM Redbooks, demos, education, and more(Index) |