MCPcopy Create free account
hub / github.com/OWASP/SecurityShepherd / doPost

Method doPost

src/main/java/servlets/MobileLogin.java:51–135  ·  view source on GitHub ↗

Initiated by login.jsp. Once this post request has been completely processed, the user will be logged in, the account will be one count closer to been temporarily been locked or will be locked out temporarily. This method takes the credentials submitted and determines if they are correct. If they ar

(HttpServletRequest request, HttpServletResponse response)

Source from the content-addressed store, hash-verified

49 * @param pwd User's Password
50 */
51 @SuppressWarnings("unchecked")
52 public void doPost (HttpServletRequest request, HttpServletResponse response)
53 throws ServletException, IOException
54 {
55 //Setting IpAddress To Log and taking header for original IP if forwarded from proxy
56 ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"));
57 log.debug("**** servlets.MobileLogin ***");
58 HttpSession ses = request.getSession(true);
59 PrintWriter out = response.getWriter();
60 out.print(getServletInfo());
61 response.setContentType("application/json");
62 // params
63 String p_login = request.getParameter("login");
64 log.debug("userName: " + p_login);
65 String p_pwd = request.getParameter("pwd");
66 String csrfToken = new String();
67
68 boolean authenticated = false;
69
70 // session is not new, try to set credentials
71 p_login = nvl(p_login, (String)ses.getAttribute("login"));
72 p_pwd = nvl(p_pwd, (String)ses.getAttribute("password"));
73 // get credentials
74 String ApplicationRoot = getServletContext().getRealPath("");
75 try
76 {
77 String user[] = Getter.authUser(ApplicationRoot, p_login, p_pwd);
78 if(user != null && !user[0].isEmpty())
79 {
80
81 //Kill Session and Create a new one with user logged in
82 log.debug("Creating new session for " + user[2] + " " + user[1]);
83 ses.invalidate();
84 ses = request.getSession(true);
85 ses.setAttribute("userStamp", user[0]);
86 ses.setAttribute("userName", user[1]);
87 ses.setAttribute("userRole", user[2]);
88 log.debug("userClassId = " + user[4]);
89
90 ses.setAttribute("userClass", user[4]);
91 log.debug("Setting CSRF cookie");
92 csrfToken = Hash.randomString();
93 Cookie token = new Cookie("token", csrfToken);
94 if(request.getRequestURL().toString().startsWith("https"))//If Requested over HTTPs
95 token.setSecure(true);
96 response.addCookie(token);
97 authenticated = true;
98
99 if(user[3].equalsIgnoreCase("true"))
100 {
101 log.debug("Temporary Password Detected, user will be prompted to change");
102 ses.setAttribute("ChangePassword", "true");
103 }
104 //Removing user from kick list. If they were on it before, their suspension must have ended if they DB authentication Succeeded
105 UserKicker.removeFromKicklist(user[1]);
106 }
107 }
108 catch(Exception e)

Callers

nothing calls this directly

Calls 6

setRequestIpMethod · 0.95
nvlMethod · 0.95
authUserMethod · 0.95
randomStringMethod · 0.95
removeFromKicklistMethod · 0.95
getSessionMethod · 0.80

Tested by

no test coverage detected