Form Authentication Servlet and MD5

Question

Dear forum,
I have the following servlet to authenticate a user via form. If you go to the root url you get the login html and the authentication works fine but if the user knows the url of a specific html just by typing the url gives access to the page without going through the authentication. The website is composed of htmls and servlets. How can I force the authentication for the htmls and the servlets. I included at the bottom how I added the Login servlet to the web.xml. I suspect that the servlet definition in the web.xml is the problem.
Also I would like to use MD5 encryption, would someone suggest how this can be accomplished.
Thanks.
This is the code:
import java.io.*;
import java.util.*;
import javax.servlet.http.*;
import javax.servlet.*;
import java.sql.*;
import javax.sql.*;
public class LoginServlet extends HttpServlet {
  public void doPost (
     HttpServletRequest     request,
     HttpServletResponse     response
    ) throws ServletException, IOException
  String item = request.getParameter("account");  
  doGet(request,response);
  public void doGet (
     HttpServletRequest     request,
     HttpServletResponse     response
    ) throws ServletException, IOException
   HttpSession session = request.getSession(true);
   PrintWriter out = response.getWriter();
     try {
          String driverName="sun.jdbc.odbc.JdbcOdbcDriver";
          String dbUrl="jdbc:odbc:Virtual_Library_DB";
          Class.forName(driverName);
          Connection db =DriverManager.getConnection(dbUrl,"","");
          if ((session.getAttribute("user") == null) || (!session.getAttribute("ip").equals(request.getRemoteAddr()))){
               PreparedStatement pStmt = db.prepareStatement("SELECT * FROM Login WHERE Login.account =? AND Login.password=? ");
               pStmt.setString(1, request.getParameter("account"));
               pStmt.setString(2, request.getParameter("password"));
                        pStmt.setString(3, request.getParameter("level"));
               ResultSet rs = pStmt.executeQuery();
                System.out.println("hello");
               if(!rs.next()){
                    System.out.println("Account is not valid.");
                    request.setAttribute("msg", "Account is not valid.");
                    RequestDispatcher rd = request.getRequestDispatcher("LoginInvalid.html");
                    rd.forward(request, response);
               else do {
                    int id = rs.getInt(1);
                    String account = rs.getString(2);
                    session.setAttribute("user", new Integer(id));
                    session.setAttribute("account", account);
                    session.setAttribute("ip", request.getRemoteAddr());
                    System.out.println("User " + session.getAttribute("user") +" has logged on.");
                    request.setAttribute("msg", "User has logged on.");
                    RequestDispatcher rd = request.getRequestDispatcher("index.html");
                    rd.forward(request, response);
               } while(rs.next());
               rs.close();
          else {
               System.out.println("User has already logged on.");
                    request.setAttribute("msg", "User has already logged on.");
                    RequestDispatcher rd = request.getRequestDispatcher("index.html");
                    rd.forward(request, response);
          db.close();
     catch(Exception exp){
          System.out.println("Exception: "+ exp);
   out.close();
web.xml
<servlet>
    <servlet-name>LoginServlet</servlet-name>
    <servlet-class>LoginServlet</servlet-class>
  </servlet>
<servlet-mapping>
    <servlet-name>LoginServlet</servlet-name>
    <url-pattern>/LoginServlet</url-pattern>
  </servlet-mapping>

Answer 1

Check the session in the servlets that are allowed only for logged-in users.
public class ServletUtils
    public static boolean checkLogin(HttpServletRequest request, HttpServletResponse response)
        HttpSession session = request.getSession(false); // false = don't create a new session if not logged in
        if (session != null)
            return true;
        Logging.log("tried to access page without login, redirecting to login");
        ...redirect to login.html...
        return false;
    // At the start of your doGet()'s:
    if (!checkLogin(request, response))
        return;Do you really need static documents to be authenticated? dot.gif's and all? Someone can make a zip file of them anyway and post it to their own web site or Kazaa.
If you have a couple of html pages you want authenticated, easiest is to write them as servlets (+ maybe JSP's) and do the login check there.
Ok, let's say you have ...what, an "image database" (heh) that you want available to logged-in users only. Write a servlet that serves those pages. That servlet checks the session, and then copies the appropriate file to the user (remember to set content type; consider caching the files if hit rate is very high.) The servlet would be called like /images/show?id=gerbilsex/closeup.gif to fetch the named file. Put the files outside the web server's document directory so they are not accessible except through the servlet. Perform strict checks on the file name to disallow nastiness like id=../../../etc/passwd. A similar database solution is also possible. Another variant is to map a servlet to a "virtual directory name" and get the actual file name from the URL path -- similar to the ?id= solution, except the URLs don't have parameters.
About md5: md5 isn't an encryption algorithm, it is a hash algorithm (aka "message digest" or "fingerprint"). It can't be decrypted. What do you really want to accomplish - encryption or hashing?