Page History

import java.util.ArrayList;
import java.util.List;
import javax.servlet.http.*;
import com.insecure.model.UserDAO;
import com.insecure.databeans.UserBean;

public class InsecureServlet extends HttpServlet {
  private UserDAO userDAO;

  // ...

  private String login(HttpServletRequest request, HttpServletResponse response) {
    List<String> errors = new ArrayList<String>protected void doPost(HttpServletRequest request,
    HttpServletResponse response) {

  // Validate input (omitted)

  String username = request.getParameter("username");
  char[] password = request.getParameter("password").toCharArray();
  boolean rememberMe = Boolean.valueOf(request.getParameter("rememberme"));
  
  LoginService loginService = new LoginServiceImpl();
        
  if (rememberMe) {
    if (request.setAttribute("errors", errors);
 
 getCookies()[0] != null && 
   String username = request.getParameter("username");.getCookies()[0].getValue() != null) {
    char  String[] passwordvalue = request.getParameter("password"getCookies()[0].getValue().toCharArraysplit(";");
  
    //
 Basic input validation
    if (!usernameloginService.matchesisUserValid("value[\\w]*") || !password.toString().matches("[\\w]*"0], value[1].toCharArray())) {
        // Set error and return
   errors.add("Incorrect user name or} password format.");
else {
        return "error.jsp";
// Forward to welcome page
      }
    } else {
    UserBean dbUser    boolean validated = thisloginService.userDAO.lookupisUserValid(username, password);
      
        if(!dbUser.checkPassword(password) (validated) {
          Cookie loginCookie = new errors.addCookie("Passwords do not match.")"rememberme", username
                             + ";" + new String(password));
      return "error.jsp";
    response.addCookie(loginCookie);
     }
 
    // Create a cookie that contains the username
    Cookie userCookie = new Cookie("username", username);
 ... Forward to welcome page
        } else {
          // Create a cookie that contains the password Set error and return
        }
    Cookie }
 passCookie = new Cookie("password", password);} else {
     // Add the cookie information to the response that the client will receiveNo remember-me functionality selected
     // Proceed with regular authentication;
    response.addCookie(userCookie);
    response.addCookie(passCookie);

    // Clear password char array
   // if it fails set error and return
   }
    
  Arrays.fill(password, ' ');

    return "welcome.jsp";
  }
}

public class InsecureServlet extends HttpServlet {
  private UserDAO userDAO;

  // ...

  private String login(HttpServletRequest request) {
    List<String> errors = new ArrayList<String>();
    request.setAttribute("errors", errors);

    String username = request.getParameter("username");
    char[] password = request.getParameter("password").toCharArray();

    // Basic input validation
    if(!username.matches("[\\w]*") || !password.toString().matches("[\\w]*")) {
      errors.add("Incorrect user name or password format.");
      return "error.jsp";
    }

    UserBean dbUser = this.userDAO.lookup(username);
    if(!dbUser.checkPassword(password)) {
      errors.add("Passwords do not match.");
      return "error.jsp";
    }

    HttpSession session = request.getSessionprotected void doPost(HttpServletRequest request,
    HttpServletResponse response) {
  
  // Validate input (omitted)

  String username = request.getParameter("username");
  char[] password = request.getParameter("password").toCharArray();
  boolean rememberMe = Boolean.valueOf(request.getParameter("rememberme"));
  LoginService loginService = new LoginServiceImpl();
  boolean validated = false;
  if (rememberMe) {
    if (request.getCookies()[0] != null &&
        request.getCookies()[0].getValue() != null) {
                             
      String[] value = request.getCookies()[0].getValue().split(";");
             
      if (value.length != 2) {
        // Set error and return
      }
             
      if (!loginService.mappingExists(value[0], value[1])) { 
        // (username, random) pair is checked
        // Set error and return
      }
    } else {
      validated = loginService.isUserValid(username, password);

      if (!validated) {
        // Set error and return
      }
    }
        
    String newRandom = loginService.getRandomString();
    // InvalidateReset the oldrandom sessionevery idtime
    sessionloginService.invalidatemapUserForRememberMe(username, newRandom);
    HttpSession session =  // Generate new session idrequest.getSession();
    session.invalidate();
    session = request.getSession(true);
    // Set session timeout to one15 hourminutes
    session.setMaxInactiveInterval(60 *60 15);
    // Store user bean within the session attribute and a random attribute in session scope
    session.setAttribute("user", dbUserloginService.getUsername());
    Cookie loginCookie = 
      // Clear password char array new Cookie("rememberme", username + ";" + newRandom);
    ArraysloginCookie.fill(password, ' ');
setHttpOnly(true);
    loginCookie.setSecure(true);
    response.addCookie(loginCookie);
    return "welcome.jsp";// ... Forward to welcome page
  }
}

 else {
    // No remember-me functionality selected
    // ... Authenticate using isUserValid() and if failed, set error
  }
  Arrays.fill(password, ' ');
}