How does j_security_check know which page to redirect to?

Question

Hi All,
I have implemented j_security_check in our weblogic web app successfully.
What I would like to know is following the authentication and authorization via the container, how does it know to redirect the user to index.jsp?
For example, we have login.jsp which contains the j_username and j_password fields, and the action is j_security_check. After the user hits submit and the container authenticates them, how does it know to then direct them to index.jsp? Is it because the welcome tag in web.xml is set up to direct them to index.jsp?
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
Thats the only thing i can think of!
Thanks in advance.

Answer 1

That's correct.
You are specifying a login page, which will ONLY be accessed when the user attempts to view a secured resource.
After logging in, they will see the page they were originally trying to get to.
They will only be forced to go to the login page if you secure the page they are trying to get to:
<security-constraint>
     <web-resource-collection>
          <web-resource-name>Resources</web-resource-name>
          <description>Require users to authenticate</description>
          <url-pattern>/upload/filelist.jsf</url-pattern>
</web-resource-collection>
<auth-constraint>
<description>Define who can access this url-pattern</description>
<role-name>NTSB Users</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>dot-ad</realm-name>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/loginError.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description>This role can access the edit</description>
<role-name>NTSB Users</role-name>
</security-role>