Comments on Tapestry Central: Securing Tapestry pages with Annotations, Part 1

Guarav, This is a blog, it's not an effective...

2012-03-13T08:20:16.926-07:00

Guarav,

This is a blog, it's not an effective discussion forum. Please join the Tapestry user mailing list and discuss there.

Hi Howards, Nice explanation,thanks a lot. I wana ...

2012-03-13T01:55:17.897-07:00

Hi Howards,
Nice explanation,thanks a lot.
I wana ask you how to implement role based security in Tapestry5(i am not intended to use third party API).
thanks
Gaurav P Singh

Hi Howard, Nice post. It seems there is an err...

2010-01-01T02:23:59.932-08:00

Hi Howard,
Nice post. It seems there is an error in the code for the RequiresLoginFilter there seems to be a constructor named PageAccessFilter.

Many thanks for this article, Howard. This supply ...

2009-12-31T02:08:36.667-08:00

Many thanks for this article, Howard. This supply us with very good, first-hand info on this topic AND it also supply us with a very interesting look at the internal working of Tapestry. Thanks again.

That is exactly what ChenilleKit Access module is ...

2009-12-29T15:27:38.701-08:00

That is exactly what ChenilleKit Access module is doing with a lot of what you're talking in here about extensions (like the "resume" after login).

I would be happy if you could give a look at the source and share your thoughts.

This is the approach I used in most Tapestry apps....

2009-12-29T08:39:45.842-08:00

This is the approach I used in most Tapestry apps. Often I do it the other way around: all pages are protected unless they are annotated with something like @PublicPage.

BTW based on your post I wrote a post about Mapped Diagnostic Context with Tapestry Filters. Read here.

Thank you Howard for this very much needed post! I...

2009-12-28T23:17:24.903-08:00

Thank you Howard for this very much needed post! It is this kind of advices that the community really needs.

Although there are lots of differences in anthenticating and authorizing users, there are also common scenarios. The most common ones are the first to be covered.

It would be most comforting for a developer to know he/she is not forgetting something to introduce a security hole in the web app.

I believe the most common simple scenario is:

- users are stored in the database
- users are of two types (regular and admins)
- part of the web site must be protected
- user must continue to the destination page after successful authentication
- username and password are used as an authentication method
- remember me functionality
- configurable logged out destination
- DenialOfService protection (captcha after 5 failed attempts)

Of course this covers nothing but the basics.

The receipe for this would really help. And what matters most to me is the clean code which everyone can understand fast even after comming to a project team later.

Cheers

I've written an answer to the mailing list. Re...

2009-12-28T16:28:31.711-08:00

I've written an answer to the mailing list. Read it here

Hi Howards, thanks a lot for this posting, even i...

2009-12-28T15:32:22.058-08:00

Hi Howards,

thanks a lot for this posting, even if I already found a solution, similar to yours, it's good to know, that others can find it now too.
I would very pleased, if you could add a hint, how you saved the targetpage & context to proceed after loggig in.

Thanks a lot
Alex