Web Form based login in Java

Question

How can I block access to the site if a user is not logged in?

Under web.xml > Security I checked Form authentication then I selected Login and Error page, but I don't know how to block the access and redirect the user to the login page.

Do I need a filter? If so, how can I get the login url I specified?

And how should I call the validation method? I saw in some examples this code

    <form method=post action="j_security_check">
     <input type="text" name="j_username" />
     <input type="password" name="j_password" />
    </form>

What does it do?

Answer 1

To prevent people who aren't logged in from viewing resources, you use security constraints. Something like this:

<security-constraint>
    <display-name>Constraint</display-name>
    <web-resource-collection>
        <web-resource-name>all-resources</web-resource-name>
        <description/>
        <url-pattern>/pages/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <description/>
        <role-name>User</role-name>
    </auth-constraint>
</security-constraint>