Question

Using container managed security on Glassfish, how can you make individual “profile” pages and restrict that only the person logged in is capable of changing it? Let say you have user “John” and “Amanda” and they both have the role “user”, how can you be sure that only “John” can change his profile page, and not “Amanda”?

<form method="POST" action="j_security_check">
    <table>
        <tr>
            <td>User name:</td>
            <td><input type="text" name="j_username" /></td>
        </tr>
        <tr>
            <td>Password:</td>
            <td><input type="password" name="j_password" /></td>
        </tr>
        <tr>
            <td><input type="submit" value="Login" /></td>
        </tr>
    </table>
</form>

Answer 1

Can’t you check if the logged in user from the session and the profile you are asked to fetch from database are the same? If they don’t match, the user cannot edit that page. Ideally, I would put this kind of user session logic in a server filter do that it can work on all requests.