关于resin的认证框架

最新推荐文章于 2024-09-01 07:02:52 发布

白乔

最新推荐文章于 2024-09-01 07:02:52 发布

阅读量1.6k

点赞数

CC 4.0 BY-SA版权

分类专栏： Web应用文章标签：框架 application path security null user

本文链接：https://blog.youkuaiyun.com/bluejoe2000/article/details/4195391

Web应用专栏收录该内容

49 篇文章

订阅专栏

在未logout的情况下，当前的用户无法重新登录成功。查看com.caucho.server.security.FormLogin源代码发现：

public Principal authenticate(HttpServletRequest request, HttpServletResponse response, ServletContext application) throws ServletException, IOException { Principal user = getUserPrincipal(request, response, application); if (user != null) return user; String path = request.getServletPath(); if (path == null) path = request.getPathInfo(); else if (request.getPathInfo() != null) path = path + request.getPathInfo(); if (path.equals("")) { // Forward? path = request.getContextPath() + "/"; response.sendRedirect(response.encodeRedirectURL(path)); return null; } Application app = (Application) application; String uri = request.getRequestURI(); if (path.endsWith("/j_security_check")) { ... } }

也就是说，即使用户重新填写登录框并提交至j_security_check，authenticate()还是优先采用已有的用户信息，因此新的认证校验永远不会被调用！