jsp - Is pageContext.request.userPrincipal stored in session? Can I get password too? -
i'm learning spring security , understand using request.getuserprincipal() access name, name pagecontext.request.userprincipal.name ,
this code (everything working) :
<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%> <%@page session="true"%> <html> <body> <h5>title : ${title}</h5> <h5>message : ${message}</h5> <c:if test="${pagecontext.request.userprincipal.name != null}"> <h2>hi user : ${pagecontext.request.userprincipal.name}></h2> <br> </c:if> </body> </html> my questions are:
1). name on pagecontext.request.userprincipal.name retrieved session? because there's <%@page session="true"%> on top of form
2). possible retrieve password also? mean pagecontext.request.userprincipal.password, if not how password in form?
thank appreciate me understand framework don't have enough money buy springs books, i'm using tutorials in internet helps mean me.
is name on pagecontext.request.userprincipal.name retrieved session?
no, it's retrieved request, not session. under covers, however, security framework may store internal identifier in http session. should least concern.
there's way shorter way retrieve principal name.
${pagecontext.request.remoteuser} see a.o. how login attributes servlet/jsp.
because there's <%@page session="true"%> on top of form
this has different meaning , default already. default, when jsp opened, implicitly create http session if not created yet. may not desirable in pages designed stateless. developers use <%@page session="false"%> turn off implicit session creation , leave servlet code. see a.o. can turn off httpsession in web.xml?
is possible retrieve password also? mean pagecontext.request.userprincipal.password, if not how password in form?
based on question's comments gather needed in order validate login. makes no sense. if login not valid, there no logged-in user in first place.
Comments
Post a Comment