throws ServletException, IOException
{
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse res = (HttpServletResponse) response;
WebApp webApp = (WebApp) getServletContext();
FormLogin login = getFormLogin(webApp.getLogin());
Principal user = login.login(req, res, true);
if (log.isLoggable(Level.FINE))
log.fine(this + " login " + user + " using " + login);
if (res.isCommitted())
return;
if (user == null) {
// A failure internally redirects to the error page (not redirect)
String errorPage = login.getFormErrorPage();
RequestDispatcherImpl disp;
disp = (RequestDispatcherImpl) webApp.getRequestDispatcher(errorPage);
// req.setAttribute("caucho.login", "login");
if (res instanceof CauchoResponse) {
((CauchoResponse) res).killCache();
((CauchoResponse) res).setNoCache(true);
}
else {
res.setDateHeader("Expires", 0);
res.setHeader("Cache-Control", "no-cache");
}
disp.error(req, res);
return;
}
HttpSession session = req.getSession();
String uri = (String) session.getAttribute(FormLogin.LOGIN_SAVED_PATH);
String query = (String) session.getAttribute(FormLogin.LOGIN_SAVED_QUERY);
session.removeAttribute(FormLogin.LOGIN_SAVED_PATH);
session.removeAttribute(FormLogin.LOGIN_SAVED_QUERY);
if (log.isLoggable(Level.FINE)) {
log.fine("old path:" + uri + " query:" + query + " j_uri:" +
req.getParameter("j_uri"));
}
boolean formURIPriority = login.getFormURIPriority();
// The saved uri has priority.
if ((uri == null || formURIPriority) && req.getParameter("j_uri") != null)
uri = req.getParameter("j_uri");
else if (uri != null && query != null)
uri = uri + "?" + query;
if (uri == null) {
log.warning(L.l("FormLogin: session has timed out for session '{0}'",
req.getSession().getId()));
RequestDispatcher disp = request.getRequestDispatcher("/");
if (disp != null) {
disp.forward(request, response);
return;
}
else {
throw new ServletException(L.l("Session has timed out for form authentication, no forwarding URI is available. Either the login form must specify j_uri or the session must have a saved URI."));
}
}
if (uri.indexOf('\n') >= 0 || uri.indexOf('\r') >= 0)
throw new ServletException(L.l("Forwarding URI '{0}' is invalid.",
uri));
String uriPwd = req.getRequestURI();
int p = uriPwd.indexOf("/j_security_check");
if (p >= 0)
uriPwd = uriPwd.substring(0, p + 1);
if (uri.length() == 0) {
}
else if (uri.charAt(0) == '/')
uri = req.getContextPath() + uri;
else if (uri.indexOf(':') >= 0 &&
(uri.indexOf(':') < uri.indexOf('/') ||
uri.indexOf('/') < 0)) {
}
else {
uri = uriPwd + uri;
}
// The spec says that a successful login uses a redirect. Resin
// adds a configuration option to allow an internal forward
// if the URL is in the same directory.
// Logins to POST pages need to use an internal forward.
// Most GETs will want a redirect.
boolean useInternalForward = login.getInternalForward();
if (useInternalForward
&& uri.startsWith(uriPwd)
&& uri.indexOf('/', uriPwd.length() + 1) < 0) {
WebApp newApp = (WebApp) webApp.getContext(uri);
String suffix = uri.substring(newApp.getContextPath().length());
// force authorization of the page because the normal forward()
// bypasses authorization
RequestDispatcher disp = newApp.getLoginDispatcher(suffix);
if (disp != null) {
disp.forward(req, res);
return;
}
}