1

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea:

  1. User try to login using a form in POST method.
  2. Login success
  3. Server generate an unique session ID string and send it to the client, than create an Hashmap with KEY = session ID and value = User object.
  4. Client store the unique session ID, Username and Password using HTML 5 localStorage.
  5. On each request, client send the SessionID, username and password and the server checks if everything matches.

So, here's my question: Is this method safe?

closed as unclear what you're asking by TildalWave, NULLZ, Xander, Eric G, Gilles Apr 19 '14 at 19:45

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Safe against what? Local storage is available to anyone using that browser on that computer. If you don't have physical safety against other people using that browser on that computer, then it is not safe. – jfriend00 Apr 18 '14 at 16:09
1

No, this is not safe and I would certainly not recommend it. However, several methods exist that fulfill your requirements (and more).

I suggest having a look at OAuth 2.0. OAuth secured services require a valid access token in the Authorization header of HTTP requests. Such a token must first be obtained from an identity provider, usually a 3rd server.

This eliminates the need to store the user's credentials in the client application, the browser in your case. Also, tokens have a limited validity: After a set amount of time, a new access token must be presented. OAuth has a mechanism to do that, without having to request the user's credentials again: When an access token is requested, a refresh token is included in the response. The refresh token has a longer validity and can be used to obtain a new access token.

  • Thanks for the answer, I've got OAuth working on Java using Scribe. But with OAuth I could only get the Access Token, But I Can't figure out how I could use it to create a session with only server side storage. The only way I could figure is storing the token in client side and password/username in server side. Is there any other way? – zearthur99 Apr 19 '14 at 0:33
  • No. The access and refresh tokens should indeed be cached in the client. The credentials are stored in the identity provider, which issues the tokens (usually a 3rd server, called the identity provider). The password should never be saved persisted in plain text, of course, but hashed with a suficciently strong hash function (e.g. SHA-2). – Steven Volckaert Apr 19 '14 at 5:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.