Java EE: Getting parameters from POST for a login form

Question

I am trying to implement a simple login servlet but it's not working properly.

What I wanted to know is how to pass the parameters using a HTTP POST. It already works with HTTP GET but the username and password are visible from the URL. It would be better to hide them in a POST.

<form method="post" action="home" >
  <input name="username" class="form-login" title="Username" value="" size="30" maxlength="2048" />
  <input name="password" type="password" class="form-login" title="Password" value="" size="30" maxlength="2048" />
  <input type="submit" value="Connect">
</form>

web.xml

  <servlet>
    <servlet-name>home</servlet-name>
    <servlet-class>controller.HomeController</servlet-class>
  </servlet>

  <servlet-mapping>
    <servlet-name>home</servlet-name>
    <url-pattern>/home</url-pattern>
  </servlet-mapping>

Servlet:

public class HomeController extends HttpServlet {

    private HttpSession session;
    private UserBean userBean;

    public void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        UserBean user = new UserBean();
        String userName = request.getParameter("username");
        String password = request.getParameter("password");

        user.setUsername(userName);
        user.setPassword(password);

        user = UserDAO.login(user);

        dispatch(request, response, ApplicationRessource.getInstance().getHomePage());
    }

    protected void dispatch(HttpServletRequest request,
                HttpServletResponse response, String page)
            throws javax.servlet.ServletException, java.io.IOException {
        RequestDispatcher dispatcher = getServletContext()
                .getRequestDispatcher(page);
        dispatcher.forward(request, response);
    }
}

The problem is that the userName and password strings are always empty, meaning that the parameters are never fetched from the POST. What am I doing wrong?

I don't know much from servlets, but in HTML you should put in the action="home" the page where you are going to recieve those parameters, action"home.jsp" also, I dont know if you need to specifiy the — Hector Sanchez, Jun 14 '12 at 15:47
What browser are you using? Please try adding encytype (application/x-www-form-urlencoded) it should be the default though... See http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.2 — Eran Medan, Jun 14 '12 at 15:48
It probably isn't important but the first input misses a type="text" attribute (though it's the default I think) — Eran Medan, Jun 14 '12 at 15:50
Swap getParameter with getAttribute and check whether that works... — helios, Jun 14 '12 at 15:53
@helios, I tried your advice, but both the `parameterMap` and the `attributes` are null — Jean-François Beaulieu, Jun 14 '12 at 16:01
try putting the url for the servlet into the action attribute — ChadNC, Jun 14 '12 at 16:02
@chad, makes no sense! Because `home` is mapped to my HomeController in the web.xml — Jean-François Beaulieu, Jun 14 '12 at 16:07
Apart from the concrete problem which is not answerable based on the information provided so far, declaring `session` and `userBean` as instance variables of the servlet is a bad idea. They will be shared by **all users** visiting the web application. http://stackoverflow.com/questions/3106452/how-do-servlets-work-instantiation-session-variables-and-multithreading/3106909#3106909 — BalusC, Jun 18 '12 at 20:43

score 1 · Accepted Answer · answered Jun 14 '12 at 15:49

1

it should work, can you check by changing form method to get and trying, you should see parameters in url.

answered Jun 14 '12 at 15:49

Subin Sebastian

10,870
3
37
42

Funny thing, it works when changing from method=post to method=get and using `doGet` instead of `doPost` – Jean-François Beaulieu Jun 14 '12 at 15:56
Only thing, it's unfortunate to see the password in the url, I still think it's beter to use a POST even if you can sniff the text using wireshark. – Jean-François Beaulieu Jun 14 '12 at 15:57
you should use post for sure :-), it was just for test. Can you try in some other browser – Subin Sebastian Jun 14 '12 at 16:09

score 0 · Answer 2 · answered Jun 14 '12 at 16:39

Please try this

In your doPost(..) method code only doGet(..) and put all your logic in doGet(..) and check if still it is giving blank values.

Let me know what is the output.

Example:-

public void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
           doGet(request,response);
}

public void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {

        UserBean user = new UserBean();
        String userName = request.getParameter("username");
        String password = request.getParameter("password");

        user.setUsername(userName);
        user.setPassword(password);

        user = UserDAO.login(user);

        dispatch(request, response, ApplicationRessource.getInstance().getHomePage());
    }

Parameters are in the url because i guess you are using "get" in your jsp. Use "post" only in your jsp and try implementing the above code. What will happen is from your servlet's "doPost" method, "doGet" will be called. Let me know what is the output. — Ankit, Jun 18 '12 at 04:13

score 0 · Answer 3 · answered Jun 18 '12 at 05:43

0

this simple implementation should have worked ..but since its not, there maybe some code which is manipulating the request. The code you have posted is not sufficient to determine that.

Some pointers I can give are -

Check your web.xml to see if there is any filter/interceptor which is manipulating the request.
Which web/app server are you using? Have you checked the service(Http...) method implementation of HttpServlet. You can try placing a debug point in service(..) method to see if the request object here has the required request parameters. If it doesn't, then the problem exists either in some filter or your jsp itself.
What does dispatch(request, response, ApplicationRessource.getInstance().getHomePage()); do? I know the problem is before this line, but this is not a standard HttpServlet method, so I assume there's lot more custom code then whats been posted in the question above.

answered Jun 18 '12 at 05:43

Kshitij

8,474
2
26
34

I have edited my original post with the web.xml and the dispatch method – Jean-François Beaulieu Jun 18 '12 at 15:53
1) The tomcat's service(..) method implementation is pretty simple and it just forwards the request to doGet(..) or doPost(..) based on request.getMethod() condition. if you haven't overridden service(..) method than there is not much to look in here. 2) Do you have any filters declared in your web.xml or any filter based annotations anywhere? – Kshitij Jun 18 '12 at 17:00
I do not use annotations, and I have no filter tags in my `web.xml`. The `dispatch()` method follows the Page Controller or Front Controller design pattern (see: http://java.sun.com/blueprints/corej2eepatterns/Patterns/FrontController.html) – Jean-François Beaulieu Jun 18 '12 at 17:10
Are you saying that the `service()` method would not be useful in this case? – Jean-François Beaulieu Jun 18 '12 at 17:10
there is no problem with your dispatch(..) method. The point which I was making earlier was that I see more custom code than what was originally posted in your question. `Are you saying that the service() method would not be useful in this case`....have you overridden service method? if not, then everything is fine with service method. – Kshitij Jun 18 '12 at 17:23

Java EE: Getting parameters from POST for a login form

3 Answers3

Linked