Develop form login pages


Before you begin

A Web client or browser can authenticate a user to a Web server using one of the following mechanisms:

The Hypertext Transfer Protocol (HTTP) basic authentication transmits a user password from the Web client to the Web server in simple base64 encoding. Form-based authentication transmits a user password from the browser to the Web server in plain text. Therefore, both HTTP basic authentication and form-based authentication are not very secure unless the HTTPS protocol is used.

The Web application deployment descriptor contains information about which authentication mechanism to use. When form-based authentication is used, the deployment descriptor also contains entries for login and error pages. A login page can be either an HTML page or a JavaServer Pages (JSP) file. This login page displays on the Web client side when a secured resource (servlet, JSP file, HTML page) is accessed from the application. On authentication failure, an error page displays. You can write login and error pages to suit the application needs and control the look and feel of these pages. During assembly of the application, an assembler can set the authentication mechanism for the application and set the login and error pages in the deployment descriptor.

Form login uses the servlet sendRedirect() method, which has several implications for the user. The sendRedirect() method is used twice during form login:



  1. Create a form login page with the required look and feel including the required elements to perform form-based authentication. For an example, see Example: Form login

  2. Create an error page. You can program error pages to retry authentication or display an appropriate error message.

  3. Place the login page and error page in the WAR file relative to the top directory. For example, if the login page is configured as /login.html in the deployment descriptor, place it in the top directory of the WAR file. An assembler can also perform this step using the assembly tool.

  4. Create a form logout page and insert it to the application only if required. This step is required when a Web application requires a form-based authentication mechanism.



See the Example: Form login article for sample form login pages.

The WAS Samples Gallery provides a form login sample that demonstrates how to use the WAS login facilities to implement and configure form login procedures. The sample integrates the following technologies to demonstrate the WAS and Java 2 Platform, Enterprise Edition (J2EE) login functionality:

The form login sample is part of the Technology Samples package. For more information on how to access the form login sample, see Accessing the Samples (Samples Gallery).


What to do next

After developing login and error pages, add them to the Web application. Use the assembly tool to configure an authentication mechanism and insert the developed login page and error page in the deployment descriptor of the application.


See also

Example: Form login


See Also

Web component security
Accessing the Samples (Samples Gallery)


See Also

Security: Resources for learning




WebSphere is a trademark of the IBM Corporation in the United States, other countries, or both.
IBM is a trademark of the IBM Corporation in the United States, other countries, or both.