Page History

import java.util.ArrayList;
import java.util.List;
import javax.servlet.http.*;
import com.rhallsrv.insecure.model.UserDAO;
import com.rhallsrv.insecure.databeans.UserBean;

public class InsecureServlet extends HttpServlet {
  private UserDAO userDAO;

  // ...

  private String login(HttpServletRequest request, HttpServletResponse response) {
    List<String> errors = new ArrayList<String>();
    request.setAttribute("errors", errors);
        
    String username = request.getParameter("username");
    String password = request.getParameter("password");
        
    // Basic input validation
    if(!username.matches("[\\w]*") || !password.matches("[\\w]*")) {
      errors.add("Incorrect user name or password format.");
      return "error.jsp";
    }
      
    UserBean dbUser = this.userDAO.lookup(username);
    if(!dbUser.checkPassword(password)) {
      errors.add("Passwords do not match.");
      return "error.jsp";
    }
        
    Cookie userCookie = new Cookie("username", username); // Create a cookie that contains the username
    Cookie passCookie = new Cookie("password", password); // Creates a cookie that contains the password
    response.addCookie(userCookie); // Send the cookie information to the client
    response.addCookie(passCookie);

    return "welcome.jsp";
  }
}

import java.util.ArrayList;
import java.util.List;
import javax.servlet.http.*;
import com.rhallsrv.insecure.model.UserDAO;
import com.rhallsrv.insecure.databeans.UserBean;

public class InsecureServlet extends HttpServlet {
  private UserDAO userDAO;

  // ...

  private String login(HttpServletRequest request, HttpServletResponse response) {
    List<String> errors = new ArrayList<String>();
    request.setAttribute("errors", errors);

    String username = request.getParameter("username");
    String password = request.getParameter("password");

    // Basic input validation
    if(!username.matches("[\\w]*") || !password.matches("[\\w]*")) {
      errors.add("Incorrect user name or password format.");
      return "error.jsp";
    }

    UserBean dbUser = this.userDAO.lookup(username);
    if(!dbUser.checkPassword(password)) {
      errors.add("Passwords do not match.");
      return "error.jsp";
    }

    HttpSession session = request.getSession();
    session.invalidate(); // Invalidate old session id
    session = request.getSession(true); // Generate new session id
    session.setMaxInactiveInterval(2*60*60); // Set session timeout to two hours
    session.setAttribute("user", dbUser); // Store user bean within the session

    return "welcome.jsp";
  }
}