I am a beginner trying to learn jsp, by creating a login page with the help of j_security_check.
In the following code from web.xml, you can see that everything in protected folder needs you to login to access it.
<welcome-file-list>
<welcome-file>protected/home.jsp</welcome-file>
</welcome-file-list>
<security-constraint>
<display-name>Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<url-pattern>/protected/*</url-pattern>
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name> manager </role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>Example Form-Based Authentication Area</realm-name>
<form-login-config>
<form-login-page>/protected/home.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<description> An administrator </description>
<role-name> manager </role-name>
</security-role>
However after entering the right credentials once, it just stays in "logged in" mode, and when I restart the server it does not prompt me to login again. I have tried using
HttpSession session=request.getSession();
session.invalidate();
as well as
<%
request.getSession().invalidate();
request.getSession(false);
%>
and also the answers on How to properly logout of a Java EE 6 Web Application after logging in (Except the last one, as something went wrong regarding FacesContext)
but they all don't seem to work. So my question is how do I logout? Is there any problem in my structure? All help is appreciated.
Simply change the login page to the actual login page:
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>