Prentice Hall and Sun Microsystems. Personal use only; do not redistribute.

4.5 Restricting Access to Web Pages

111

Listing 4.3 ProtectedPage.java (continued)

      BASE64Decoder decoder = new BASE64Decoder();

      String nameAndPassword =

        new String(decoder.decodeBuffer(userInfo));

      int index = nameAndPassword.indexOf(":");

      String user = nameAndPassword.substring(0, index);

      String password = nameAndPassword.substring(index+1);

      String realPassword = passwords.getProperty(user);

      if ((realPassword != null) &&

          (realPassword.equals(password))) {

        String title = "Welcome to the Protected Page";

        out.println(ServletUtilities.headWithTitle(title) +

                    "\n" +

                    "
" + title + "
\n" +

                    "Congratulations. You have accessed a\n" +

                    "highly proprietary company document.\n" +

                    "Shred or eat all hardcopies before\n" +

                    "going to bed tonight.\n" +

                    "");

      } else {

        askForPassword(response);

      }

    }

  }

  // If no Authorization header was supplied in the request.

  private void askForPassword(HttpServletResponse response) {

    response.setStatus(response.SC_UNAUTHORIZED); // Ie 401

    response.setHeader("WWW Authenticate",

                       "BASIC realm=\"privileged few\"");

  }

  public void doPost(HttpServletRequest request,

                     HttpServletResponse response)

      throws ServletException, IOException {

    doGet(request, response);

  }

}

Second edition of this book: www.coreservlets.com; Sequel: www.moreservlets.com.

Servlet and JSP training courses by book's author: courses.coreservlets.com.