type Status report
message Invalid direct reference to form login page
description The request sent by the client was syntactically incorrect (Invalid direct reference to form login page).
I am developing an application using form-based uthorization in Tomcat 4.0.3.
(My basic problem is that I want to log out, but until then I have another problem first..)
In my web.xml I have defined the login page:
The login page basically consist of the standard
<form name="loginForm" method="POST" action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">
<input type="submit" value="Login Now">
It all works fine. When I try to access web-resource-collections protected by a security-constraint in web.xml I get redirected to login.jsp.
But if I go to login.jsp directly I get this strange behavior:
When entering correct user/pwd I get the error message "Apache Tomcat/4.0.3 - HTTP Status 400 - Invalid direct reference to form login page". But when entering an incorrect user/pwd I get send to the loginError.jsp page. Which means that at least the user/pwd get checked.
So can I or can't I link directly to the login.jsp page and perform a login? Any ideas?
You can't simply point a browser at the login page because there's no way to tell it where to got next! The login page's action is a builtin process, not a servlet or JSP that could then move you along to the next page.
The idea behind the login facility is that since a user can jump into any part of a webapp that has a distinct URL, thus bypassing a login page, the whole login process is moved external to the webapp so that if someone addresses the webapp and they are not yet logged in, the original URL is intercepted, the login form is presented, and if (and ONLY if) the login succeeds will the original URL be presented.
I also discovered to my pain that in Tomcat, a login form containing page-external references (such as CSS links) loses that saved URL, so it's best to keep the login page plain.