Jdeveloper 10g security using jazn

Question

Hello,
in my adf 10g application I am using JDeveloper 10.1.3.2
I need to secure my application, after using custom log-in module and html form page to authenticate the users using a database procedure the user should be redirected to the page he requested.
It works fine, Except for one case that is : when I try to access any page ,I am forwarded to the log-in form ,wait for the current session(anonymous session) to timeout (set my application to timeout after 1 minute for testing purpose) ,after the timeout interval I submit my credentials then I should get redirected to the requested page. instead I am faced with page not found.
Note:in the production environment the time out is set to 15 minute.
this is my understandiong of the authentication process- correct me if I am mistaken:
<ol>
<li>request a certain page.</li>
<li> if there is no JSessionID for authenticated session then:
<ul>
<li>create an anonymous session .</li>
<li>store the requested page url in the session.</li>
<li> forward the request to the log-in form.</li>
<li> set a header for a cookie in the response that contain the anonymous session id.</li>
<li>the user submit credentials through the page -the request will now have id of the anonymous session. </li>
<li> authenticate the user through submitted values.</li>
<li>if credentials are valid then forward to the requested page url which is saved in the anonymous session</li>
</ul>
</li>
</ol>
but since the session timed out a new anonymous session will be created but this one will not have the requested page url which causes the error.
so, is there any way to specify a default page (my main page) that all users will be redirected to upon successful log-in regardless of the requested page?

Answer 1

Hi,
you can use a servlet filter to detect if a session has expired. Upon first access, check if the session is authenticated, if it is not then you do whatever needs to be done. If the session is authenticated and the request doesn't contain a custom session key (indicating that a previously created session is used) you perform a redirect to your home page. Make sure hat once the redirect to your home page happens you set the custom session flag so that successive requests are not redirected
Frank