How to forward to j_security_check?

Question

I'm using form based authentication (JBOSS/JAAS) but my form is sending the data to my Servlet so I can perform some checks before trying to login.

Now I need to forward to j_security_check but what I tried didn't work (404 error)...

How can I redirect/forward to the j_security_check (please note the application is running over https / sssl) ?

I can make it work with a redirect and the params go in the URL, but that is not safe (as the user/pass stays in the browser history, etc)...

Any ideas?

Answer 1

Tomcat only accepts requests to j_security_check if it initiated a login process before for that session. So first you need to try to access a security-constraint resource. Then Tomcat will redirect you to the login form. Only then are you allowed to access j_security_check.