I have a webapp which currently authenticates using the Form based authentication method. I want to extend it now such that on the home page, the user will only provide his user id and after processing it on the server, he will be shown the login page with password. Is there a way to extend/customise the Form based authentication in tomcat to achieve this?
0
votes
Whats the purpose of the first step? Are you weeding out incorrect usernames by checking against the db? It makes it easier for a brute force hacker since instead of simultaneously guessing both username/pwd - he can get in to username first.
- JoseK
Validating userid is one of the purposes. I also want to route users to different servers according to their properties. In future I also want to implement salted-hash password scheme where the salt will be generated on the server after the userid is received. The password will be hashed in the browser using this salt and sent back to the server.
- amol
1 Answers
0
votes
Easiest way would be to store the username as a session attribute, then when the second page is requested, retrieve it and use it to do whatever it is you're doing.
