I’m developing some web service using Resin and at the beginning I was using a servlet to log users but I quit and decided to user a class provided by resin called AbstractAuthenticator. At the end I feel although it was easier it ended up being the same since there’s no encryption and now the user and password are naked in the URL. So my question is how common it is to user servlet for a login form? What is the most common approach to this? I know I will end up using SSL since using a digest authentication provided by the browser window is very obtrusive.
Share
That it’s a servlet isn’t why the username/password are in the URL, that’s because it’s a GET request and not a POST.
Login forms can be handled by any number of back-end technologies, while a great many people use a framework, there’s no technical reason it can’t be handled by a servlet.