Re: Security Issue with built-in form-based login

Tibi

I though you had identified the cause of my problem as my security
configuration was at the server level in resin.conf. However I have now
tried the security configuration at the server, host, and web-app level
in resin.conf and the same behaviour occurs after restart of resin.

I can see how it is more of an application than a resin problem - I will
try your suggestion of killing the session in the login.jsp page. Longer
term I will probably develop a custom authenticator.

Thanks

Alan Wright

Tiberiu Fustos wrote:

>Hi,
>
>I was wondering if my understanding is correct: if your authenticator is
>configured at web-app level, the user is logged out when the session with
>that specific web-app is killed? However, if the authenticator is configured
>at host level, then you might still be logged in in other sessions with
>other web-apps. That's the reason why killing the session is not enough to
>completely log out in certain configurations.
>
Received on Thu 18 Apr 2002 03:47:13 -0700