package de.fhswf.in.inf.fit.aufgabe3;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebInitParam;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* Servlet implementation class LoginServlet
*/
@WebServlet(urlPatterns = { "/LoginServlet" }, initParams = {
@WebInitParam(name = "username", value = "admin"),
@WebInitParam(name = "password", value = "12345") })
public class LoginServlet extends HttpServlet
{
private static final long serialVersionUID = 1L;
/**
* @see HttpServlet#HttpServlet()
*/
public LoginServlet()
{
super();
}
/**
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse
* response)
*/
protected void doGet(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException
{
response.sendRedirect("LoginForm.jsp");
}
/**
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse
* response)
*/
protected void doPost(HttpServletRequest request,
HttpServletResponse response) throws ServletException, IOException
{
String validUsername = getInitParameter("username");
String validPassword = getInitParameter("password");
String requestUsername = request.getParameter("username");
String requestPassword = request.getParameter("password");
if (requestUsername == null || requestPassword == null)
{
doGet(request, response);
}
PrintWriter pw = response.getWriter();
pw.println("");
pw.println("");
pw.println("");
pw.println("");
pw.println("Login Answer");
pw.println("");
pw.println("");
// This is very insecure and can be exploited via timing attacks
if (requestUsername.equals(validUsername)
&& requestPassword.equals(validPassword))
{
pw.println("Success
");
}
else
{
pw.println("Failed
");
pw.println("Retry");
}
pw.println("");
pw.println("");
}
}