The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

Defining Security Requirements forWeb Applications
856
The authentication mechanisms are discussed further in the following sections:
■ “HTTP Basic Authentication” on page 856
■ “Form-Based Authentication” on page 857
■ “HTTPS Client Authentication” on page 859
■ “Digest Authentication” on page 862
HTTP Basic Authentication
HTTP Basic Authentication requires that the server request a user name and password from the
web client and verify that the user name and password are valid by comparing them against a
database of authorized users. When basic authentication is declared, the following actions
occur:
1. A client requests access to a protected resource.
2. The web server returns a dialog box that requests the user name and password.
3. The client submits the user name and password to the server.
4. The server authenticates the user in the specified realm and, if successful, returns the
requested resource.
Figure 30–2 shows what happens when you specify HTTP basic authentication.
FIGURE 30–2 HTTP Basic Authentication
1
Requests a protected resource
Client 2
Requests username:password
3
Sends username:password
4
Returns requested resource
The following example shows how to specify basic authentication in your deployment
descriptor:
BASIC
The Java EE 5Tutorial • June 2010
Server