Ajax and form authentication

Question

I am trying to implement form authentication in my ajax application. The problem I have is that when the session expires I get 302 code which redirects me to a login page I specified in web.xml (and it messes everything up refreshing the whole app to login page).

What I want to do is to get a "not authenticated" (401) code, then display the login form in a popup window and when the login is successful continue with what I was doing.

here is a picture of what is going on:

and the docs http://docs.oracle.com/javaee/1.4/tutorial/doc/Security5.html

basically, I want to display the popup instead of redirect to login page and then don't do the redirect to the resource but do my update in AJAX way. From what I understand it couldn't be done only on the client side since the redirect can't be avoided (see here: redirect info), I would need to write some kind of logic on the server to prevent redirect, see here for detail about doing it in IIS: IIS implementation

P.S. So far this: http://www.oracle.com/technetwork/articles/entarch/session-lifecycle-096133.html looks like the most promising way to implement it. The class is deprecated, but I can't find the new one and think it's the only way to do it for Weblogic.

Answer 1

This is not an easy way but still it works

You have a form in your page which is filled by the user.

User clicks submit button.

An ajax request is sent to the server.

The server side implementation can check whether session exists or not. and accordingly you can send a response code 401..(response.setStatus());

This 401 can be checked in client side using ajax --- xhr.status

If response is 401 you can show the login form and hide the current form. using js and css.

User fills in the login details and clicks submit..

You can do the same server side check and client side check for the status of that login request.

if login is successful then you can you can submit the first form using ajax or js..

Answer 2

You may need to use servlet authentication filters as described in weblogic.xml Deployment Descriptor Elements

Below tutorials may help you:
oracle Servlet Authentication Filters
Using servlet filters for user authentication
Writing Servlet Filters