Page History

import java.util.ArrayList;
import java.util.List;
import javax.servlet.http.*;
import com.insecure.model.UserDAO;
import com.insecure.databeans.UserBean;

public class InsecureServlet extends HttpServlet {
  private UserDAO userDAO;

  // ...

  private String login(HttpServletRequest request, HttpServletResponse response) {
    List<String> errors = new ArrayList<String>();
    request.setAttribute("errors", errors);
protected void doPost(HttpServletRequest request,
    HttpServletResponse response) {

  // Validate input (omitted)

  String username = request.getParameter("username");
  char[] password = request.getParameter("password").toCharArray();
  boolean rememberMe = Boolean.valueOf(request.getParameter("rememberme"));
  
  LoginService loginService = new LoginServiceImpl();
        
  if (rememberMe) {
    if (request.getCookies()[0] != null && 
    String username = request.getParameter("username");getCookies()[0].getValue() != null) {
    char  String[] passwordvalue = request.getParameter("password").toCharArray(.getCookies()[0].getValue().split(";");
  
    //
 Basic input validation
    if (!usernameloginService.matchesisUserValid("value[\\w]*") || !password.toString().matches("[\\w]*"0], value[1].toCharArray())) {
         errors.add("Incorrect user name or password format.");// Set error and return
      } else {
      return "error.jsp";  // Forward to welcome page
      }
    } else {
        UserBeanboolean dbUservalidated = thisloginService.userDAO.lookupisUserValid(username, password);
      
        if (!dbUser.checkPassword(password))validated) {
          Cookie loginCookie  errors.add("Passwords do not match.")= new Cookie("rememberme", username
                             + ";" + new String(password));
      return "error.jsp";
    response.addCookie(loginCookie);
     }
 
    // Create a cookie that contains the username
    Cookie userCookie = new Cookie("username", username);
 ... Forward to welcome page
        } else {
          // Create a cookie that contains the password Set error and return
        }
    Cookie }
 passCookie = new Cookie("password", password);} else {
     // No Addremember-me thefunctionality cookieselected
 information to the response that// theProceed clientwith willregular receiveauthentication;
     response.addCookie(userCookie);
    response.addCookie(passCookie);

    // Clear password char array
  // if it fails set error and return
   }
    
  Arrays.fill(password, ' ');

    return "welcome.jsp";
  }
}

public class InsecureServlet extends HttpServletprotected void doPost(HttpServletRequest request,
    HttpServletResponse response) {
  
  // privateValidate UserDAO userDAO;input (omitted)

  String username //= request.getParameter("username");
  char[] password = request.getParameter("password").toCharArray();

  boolean privaterememberMe String= loginBoolean.valueOf(HttpServletRequest request) {request.getParameter("rememberme"));
  LoginService loginService = new LoginServiceImpl();
  boolean validated List<String>= errorsfalse;
 = newif ArrayList<String>(rememberMe); {
    if (request.setAttribute("errors", errors);

getCookies()[0] != null &&
     String username = request.getParameter("username");
getCookies()[0].getValue() != null) {
                             
      charString[] passwordvalue = request.getParameter("password"getCookies()[0].getValue().toCharArraysplit(";");
             
      if (value.length != 2) {
        // Basic input validationSet error and return
      }
             
      if (!usernameloginService.matchesmappingExists("value[\\w]*") || !password.toString().matches("[\\w]*"0], value[1])) { 
       errors.add("Incorrect user name or password format.");
  // (username, random) pair is checked
        // returnSet "error.jsp";
error and return
      }
    } else {
    UserBean  dbUservalidated = thisloginService.userDAO.lookupisUserValid(username, password);

     if if (!dbUser.checkPassword(passwordvalidated)) {
      errors.add("Passwords do not match.");  // Set error and return
      return "error.jsp";}
    }
        
    HttpSessionString sessionnewRandom = requestloginService.getSessiongetRandomString();
    // InvalidateReset the oldrandom sessionevery idtime
    sessionloginService.invalidatemapUserForRememberMe(username, newRandom);
    // Generate new session id HttpSession session = request.getSession();
    session.invalidate();
    session = request.getSession(true);
    // Set session timeout to one15 hourminutes
    session.setMaxInactiveInterval(60 *60 15);
    // Store user bean within the session attribute and a random attribute in session scope
    session.setAttribute("user", dbUserloginService.getUsername());
    Cookie loginCookie = 
    // Clear password char array  new Cookie("rememberme", username + ";" + newRandom);
    ArraysloginCookie.fill(password, ' ');

    return "welcome.jsp";
  }
}

setHttpOnly(true);
    loginCookie.setSecure(true);
    response.addCookie(loginCookie);
    // ... Forward to welcome page
  } else {
    // No remember-me functionality selected
    // ... Authenticate using isUserValid() and if failed, set error
  }
  Arrays.fill(password, ' ');
}