Question

I’ve been trying to make a web service that receives a username and password and returns some sort of session that tells the receiver what they can and cannot do.

1. Where and how does Spring handle sessions and permissions?
2. On my login form I have

<form method="POST" action="<c:url value="/j_spring_security_check"
/>">

What does this do and is it possible to create a web service that does the same thing?

Answer 1

I think your project is integrated with spring-security plugin. <c:url value="/j_spring_security_check"> –This line submit userid,paswd to spring security interceptor which in turn decide to call service or do whatever as mentioned in spring-security.xml file. check for following code in your web.xml file for confirmation..

    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping> 

Post your spring configuration.xml file and web.xml for more analysis. For authentication why you want to write webservice? For more information on spring security read the doc http://static.springsource.org/spring-security/site/