Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [lyo-dev] Reuse HttpClient session in Browser
Since the session is https, the password is not in the clear over the wire.   But, unless your are taking extra steps, it is in the clear in memory.  Open a bug if there are any OSLC4J messages displaying plaintext passwords, though - that would be bad.

Regards,
Mike


On Mon, May 13, 2013 at 3:03 PM, Nils Kronqvist <nissekronqvist@xxxxxxxxxxx> wrote:

On 13 maj 2013, at 19:53, Michael Fiedler <fiedler.mf@xxxxxxxxx> wrote:

I don't believe this can be done (someone correct me if I'm wrong here).   RTC relies on session-specific information (cookies like JSESSIONID) to tell if you are authenticated.   Since the browser would have its own session, there's no way to "share" your existing JazzFormAuthClient's authentication.  The form auth code does do exactly what you did to login by hitting the j_security_check URL.   It follows some redirects to get there and picks up some cookies on the way.   So, that is not an incorrect way to do it.
[Nils] OK, thanks. I guess my main issue is the showing of the pw in plaintext in the error message. 

Are  you able to hit the login URL and then send the SWT Browser to the real url you want?
[Nils] Yes, that is working. 


Regards,
Mike


On Wed, May 8, 2013 at 12:14 AM, Nils Kronqvist <nissekronqvist@xxxxxxxxxxx> wrote:
Hi,

I'm using the JazzFormAuthClient (i.e. according to the RTCFormClient sample) to access ChangeRequests, and would like to open a SWT Browser on a preview url *without* having to authenticate again for the Browser. I found I could login by passing  https://myserver:9443/ccm/j_security_check?j_username=myname&j_password=mypassword for the Browser, but not sure if this is the right way to do it. Besides, I get a warning that the security certificate of the server is not valid on 1:st call (reason not related to this, but still ..) -- and then showing the url with the pw ... 

Also tried other ideas found on the net, but no luck so far. Any pointers ..?

Rgs,

/Nils K  


_______________________________________________
lyo-dev mailing list
lyo-dev@xxxxxxxxxxx
http://dev.eclipse.org/mailman/listinfo/lyo-dev


_______________________________________________
lyo-dev mailing list
lyo-dev@xxxxxxxxxxx
http://dev.eclipse.org/mailman/listinfo/lyo-dev


_______________________________________________
lyo-dev mailing list
lyo-dev@xxxxxxxxxxx
http://dev.eclipse.org/mailman/listinfo/lyo-dev


Back to the top