Reject GET Method on j_security_check

Question

Is there a way to only allow POST requests to j_security_check? I want to reject GETs. I am using Form Based security and want to only allow Posts to j_security_check. If a login request is made via a GET, the request should be rejected.

Answer 1

Having been trying to do the same on a JBOSS(Tomcat) server due to security concerns of JAAS using GET methods I attempted various ways.

1. Using a web.xml security constraint on the url pattern /j_security_check to only use POST - This doesn't work for JAAS mechanism as it would for normal servlets.

2. Passing login details from the login page to an intermediate servlet which checked the request method and if not a GET then forwarding on to j_security_check. - This did'nt work and was over complicated.

3. Creating a Filter that would check the request method and only invoke on a POST message to j_security_check - This didn't work as JAAS is deeper in web container and is called before the filter mechanism.

4. Creating a Valve, which DOES get called before the JAAS.

By adding the following in the invoke method:

HttpServletRequest req = (HttpServletRequest) request;
if (req.getMethod().equals("GET")) {
 log.warn("Someone is trying to use a GET method to login!!");                       
 request.getRequestDispatcher("/login.jsp").forward(req, response);
 throw new ServletException("Using a GET method on security check!");
}

This does work.

Answer 2

Yes you can reject the GET request. In the web.xml file in the security constraint section you can specifiy the http methods allowed. In the following xml the only method allowed for this security constraint is the POST method. j_security check will only allow the post method.

<security-constraint>
  <display-name>Your security constraint</display-name>
  <web-resource-collection>
     <web-resource-name>Your resource name</web-resource-name>
     <url-pattern>/The URL pattern</url-pattern>
     <http-method>POST</http-method>
  <web-resource-collection>
<security-constraint>