IBM WebSphere V5.0 Security - CGISecurity

4.5.2 Custom loginThere are situations when the login facility, using the j_security_check servletprovided by WebSphere, does not fulfil all the requirements for the application. Inthese cases, developers can extend the login facility and develop an extension tothe existing code.In the earlier versions of WebSphere Application Server, developers could usethe Custom Login facility of WebSphere; which has been deprecated sinceversion 4 of WebSphere Application Server.According to the new programming model, developers should use servlet filtersto implement pre-login or post-login processes.The following section will provide a short introduction of servlet filters and asample filter to perform post-login processing for the application.Using servlet filters to modify the login processJava Servlet API V 2.3 introduces a new object called a filter which cantransform a request or modify a response or header information. Filters can bechained together to act on the input and output of a specified resource or groupof resources. They do not usually create a response. The main role of filters is tomodify or adapt the response. Typical uses of filters include:1. Logging information.2. Transforming the content on the fly (image transformation, encryption, XMLtransformation, compression, and so on).3. MIME type filters (functionally equivalent to the old-style servlet chaining).4. Customized authentication of Web resources.5. Caching information.A filter can be configured to act upon a certain request. A difference betweenJSP/servlet and filter processing is that filter can be mapped and work across thesubset (or all) of the URLs served by the application.A filter’s lifecycle is very similar to a servlet’s. The configuration of all filters in agiven Servlet container is kept in the FilterConfig object. Each filter can accessthis object in order to get the initialization parameters and a reference to theServletContext and to load the information necessary for performing filterprocessing (for example, the data needed for filtering functions).62 IBM WebSphere V5.0 Security Handbook