Form based j_security_check with javax.servlet.Filter and some pesky images

Question

We have defined the web app to use Form based authentication. Some of the images internal to our application we would like to allow access without having to formally log into the system. In order to accomodate this we have created an javax.servlet.Filter where we strip off some parameters off of the end of the url to log them in.
This works great for everything EXCEPT urls that are in <img src> tags. urls in these tags will never hit the filter. You can take the same url and place it in the browser and it will hit the filter. Its just urls in <img src> tags.
The images cannot be moved to a public place, they must stay where they are.
Does anyone know why the <img src> tag is doing this? It is fairly easy to replicate. Just use form based authentication, create a filter, and try to access an image from an img src tag.
Be sure to clear your browser cache and try again if you think you have it working.
Any security gods out there?
Thanks,
Mark

Answer 1

Since nobody responded, I will tell you what we decided to do. For images, we use a servlet outside of the security wall that loads and streams an image back to the browser instead of a direct image url.
So we do something like this:
<img src="https:\\foo.com\Servlet\ImageDisplay?id=1234&user=23432">
Then our servlet parses the params, finds and streams back the image, and instead of returning back "html\text" in the servlet, the servlet returns something like this:
HttpServletResponse response = blah...
BufferedImage bi = new BufferedImage("load in the image resource");
try {
response.setContentType("image/gif");
ServletOutputStream out = response.getOutputStream();
JPEGImageEncoder encoder = JPEGCodec.createJPEGEncoder(out);
encoder.encode(bi);
catch (IOException ioe) {
servlet.log("DrawMapAction: IO Exception encoding JPEG to ServletOutputStream.", ioe);
}