Help with Login Form (JSP DB Java Beans Session Tracking)

Question

Hi, I need some help with my login form.
The design of my authetication system is as follows.
1. Login.jsp sends login details to validation.jsp.
2. Validation.jsp queries a DB against the parameters received.
3. If the query result is good, I retrieve some information (login id, name, etc.) from the DB and store it into a Java Bean.
4. The bean itself is referenced with the current session.
5. Once all that's done, validation.jsp forwards to main.jsp.
6. As a means to maintain state, I prefer to use url encoding instead of cookies for obvious reasons.I need some help from step 3 onwards please! Some code snippets will do as well!
If you think this approach is not a good practice, pls let me know and advice on better practices!
Thanks a lot!

Answer 1

Alright,here is an example for you.
Assume a case where you don't want to give access to any JSP View/HTML Page/Servlet/Backing Bean unless user logging system and let assume you are creating a View Object with the name.
checkout an example (Assuming the filter is being applied to a pattern * which means when a resource is been accessed by webapplication using APP_URL the filter would be called)
public doFilter(ServletRequest req,ServletResponse res,FilterChain chain){
     if(req instanceof HttpServletRequest){
            HttpServletRequest request = (HttpServletRequest) req;
            HttpSession session = request.getSession();
            String username = request.getParameter("username");
            String password = request.getParameter("password");
            String method = request.getMethod();
            String auth_type  = request.getAuthType();
            if(session.getAttribute("useInfoBean") != null)
                request.getRequestDispatcher("/dashBoard").forward(req,res);
            else{
                    if(username != null && password != null && method.equaIsgnoreCase("POST") && (auth_type.equalsIgnoreCase("FORM_AUTH") ||  auth_type.equalsIgnoreCase("CLIENT_CERT_AUTH")) )
                         chain.doFilter(req,res);
                    else 
                      request.getRequestDispatcher("/Login.jsp").forward(req,res);
}If carefully look at the code the autherization is given only if either user is already logged in or making an attempt to login in secured way.
to know more insights about where these can used and how these can be used and how ?? the below links might help you.
http://javaboutique.internet.com/tutorials/Servlet_Filters/
http://e-docs.bea.com/wls/docs92/dvspisec/servlet.html
http://livedocs.adobe.com/jrun/4/Programmers_Guide/filters3.htm
http://www.javaworld.com/javaworld/jw-06-2001/jw-0622-filters.html
http://www.servlets.com/soapbox/filters.html
http://www.onjava.com/pub/a/onjava/2001/05/10/servlet_filters.html
and coming back to DAO Pattern hope the below link might help you.
http://java.sun.com/blueprints/corej2eepatterns/Patterns/DataAccessObject.html
http://java.sun.com/blueprints/patterns/DAO.html
http://www.javapractices.com/Topic66.cjp
http://www.ibm.com/developerworks/java/library/j-dao/
http://www.javaworld.com/javaworld/jw-03-2002/jw-0301-dao.html
On the whole(:D) it is always a good practice to get back to Core Java/J2EE Patterns.and know answers to the question Why are they used & How do i implement them and where do i use it ??
http://www.fluffycat.com/java-design-patterns/
http://java.sun.com/blueprints/corej2eepatterns/Patterns/index.html
http://www.cmcrossroads.com/bradapp/javapats.html
Hope that might help :)
REGARDS,
RaHuL