From dc0bc99b609456b5559e61e0410c4d9718f38b1f Mon Sep 17 00:00:00 2001 From: lawson89 Date: Mon, 2 Jun 2014 16:00:58 -0400 Subject: [PATCH] add form based login --- java/org/owasp/webgoat/controller/Login.java | 39 ++++++++++++ webapp/WEB-INF/mvc-dispatcher-servlet.xml | 4 +- webapp/WEB-INF/pages/login.jsp | 66 ++++++++++++++++++++ webapp/WEB-INF/spring-security.xml | 20 ++++-- 4 files changed, 122 insertions(+), 7 deletions(-) create mode 100644 java/org/owasp/webgoat/controller/Login.java create mode 100644 webapp/WEB-INF/pages/login.jsp diff --git a/java/org/owasp/webgoat/controller/Login.java b/java/org/owasp/webgoat/controller/Login.java new file mode 100644 index 000000000..f770caacb --- /dev/null +++ b/java/org/owasp/webgoat/controller/Login.java @@ -0,0 +1,39 @@ +/* + * To change this license header, choose License Headers in Project Properties. + * To change this template file, choose Tools | Templates + * and open the template in the editor. + */ +package org.owasp.webgoat.controller; + +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestMethod; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.servlet.ModelAndView; + +/** + * + * @author rlawson + */ +@Controller +public class Login { + + @RequestMapping(value = "login.do", method = RequestMethod.GET) + public ModelAndView login( + @RequestParam(value = "error", required = false) String error, + @RequestParam(value = "logout", required = false) String logout) { + + ModelAndView model = new ModelAndView(); + if (error != null) { + model.addObject("error", "Invalid username and password!"); + } + + if (logout != null) { + model.addObject("msg", "You've been logged out successfully."); + } + model.setViewName("login"); + + return model; + + } +} diff --git a/webapp/WEB-INF/mvc-dispatcher-servlet.xml b/webapp/WEB-INF/mvc-dispatcher-servlet.xml index d9483ac24..73c052a95 100644 --- a/webapp/WEB-INF/mvc-dispatcher-servlet.xml +++ b/webapp/WEB-INF/mvc-dispatcher-servlet.xml @@ -11,7 +11,7 @@ http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd"> - + - + diff --git a/webapp/WEB-INF/pages/login.jsp b/webapp/WEB-INF/pages/login.jsp new file mode 100644 index 000000000..18516f4c7 --- /dev/null +++ b/webapp/WEB-INF/pages/login.jsp @@ -0,0 +1,66 @@ +<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%> + + + Login Page + + + + + + +
+ +
${error}
+ + +
${msg}
+ + + +
+ + + + + \ No newline at end of file diff --git a/webapp/WEB-INF/spring-security.xml b/webapp/WEB-INF/spring-security.xml index 98003eafc..c194c1aee 100644 --- a/webapp/WEB-INF/spring-security.xml +++ b/webapp/WEB-INF/spring-security.xml @@ -10,11 +10,21 @@ NOTE: Without Spring security, HttpServletRequest.getUserPrincipal() returns null when called from pages under Spring's control. That method is used extensively in legacy webgoat code. Integrating Spring security into the application resolves this issue. --> - - - - - + + + + + + + + + +