MCPcopy Create free account
hub / github.com/OWASP/SecurityShepherd / doPost

Method doPost

src/main/java/servlets/Login.java:49–142  ·  view source on GitHub ↗

Initiated by login.jsp. Once this post request has been completely processed, the user will be logged in, the account will be one count closer to been temporarily been locked or will be locked out temporarily. This method takes the credentials submitted and determines if they are correct. If they ar

(HttpServletRequest request, HttpServletResponse response)

Source from the content-addressed store, hash-verified

47 * @param pwd User's Password
48 */
49 public void doPost (HttpServletRequest request, HttpServletResponse response)
50 throws ServletException, IOException
51 {
52 //Setting IpAddress To Log and taking header for original IP if forwarded from proxy
53 ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
54 log.debug("**** servlets.Login ***");
55 HttpSession ses = request.getSession(true);
56 try
57 {
58 response.setContentType("text/plain");
59 // params
60 String p_login = request.getParameter("login");
61 String p_pwd = request.getParameter("pwd");
62 Object language = ses.getAttribute("lang");
63
64 boolean mustRedirect = false;
65
66 // session is not new, try to set credentials
67 p_login = nvl(p_login, (String)ses.getAttribute("login"));
68 p_pwd = nvl(p_pwd, (String)ses.getAttribute("password"));
69 // get credentials
70 log.debug("Getting ApplicationRoot");
71 String ApplicationRoot = getServletContext().getRealPath("");
72 log.debug("Servlet root = " + ApplicationRoot );
73 try
74 {
75 String user[] = Getter.authUser(ApplicationRoot, p_login, p_pwd);
76 if(user != null && !user[0].isEmpty())
77 {
78
79 //Kill Session and Create a new one with user logged in
80 log.debug("Creating new session for " + user[2] + " " + user[1]);
81 ses.invalidate();
82 ses = request.getSession(true);
83 ses.setAttribute("userStamp", user[0]);
84 ses.setAttribute("userName", user[1]);
85 ses.setAttribute("userRole", user[2]);
86 ses.setAttribute("lang", language);
87 log.debug("userClassId = " + user[4]);
88
89 ses.setAttribute("userClass", user[4]);
90 log.debug("Setting CSRF cookie");
91 Cookie token = new Cookie("token", Hash.randomString());
92 if(request.getRequestURL().toString().startsWith("https"))//If Requested over HTTPs
93 token.setSecure(true);
94 response.addCookie(token);
95 mustRedirect = true;
96
97 if(user[3].equalsIgnoreCase("true"))
98 {
99 log.debug("Temporary Password Detected, user will be prompted to change");
100 ses.setAttribute("ChangePassword", "true");
101 }
102
103 //Removing user from kick list. If they were on it before, their suspension must have ended if they DB authentication Succeeded
104 UserKicker.removeFromKicklist(user[1]);
105 }
106 }

Callers 3

loginDoPostMethod · 0.95
loginDoPostMethod · 0.95
loginDoPostMethod · 0.95

Calls 6

setRequestIpMethod · 0.95
nvlMethod · 0.95
authUserMethod · 0.95
randomStringMethod · 0.95
removeFromKicklistMethod · 0.95
getSessionMethod · 0.80

Tested by 3

loginDoPostMethod · 0.76
loginDoPostMethod · 0.76
loginDoPostMethod · 0.76