Authentication without Javascript enabled

• Key: JS2-229
• Type: Bug
• Status: Resolved
• Resolution: Won't Fix
• Priority: Minor
• Assignee: Ate Douma
• Reporter: Artem Grinshtein
• Component/s: Security
• Affects Version/s: 2.0-M2

Description

you can't login without Javascript enabled. HTML output of LoginServlet contains a 'invisible' form and javascript to submit it.

Comments

[Artem Grinshtein]

HTML form and javascript are replaced with response.sendRedirect

[Ate Douma]

Although I would like to be able to remove the Javascript requirement for the active Login functionality,
I wouldn't replace it with your solution because:
- It is less secure
  using a redirect with the username and password as query string parameters will make it much easier
  to hack into your account
- Some web/application servers *require* that the j_security_check action is accessed using form POST.
  It may work with the server (version) you have tested it against, but it may break on others.
  I know this for sure because I tested that out before I implemented the active Login as it is right now.

I'm sorry, but I don't think active Login can be implement (portable and secure) without requiring Javascript.
If you can't enforce that I suggest falling back to using an "old" style login form and providing only a link
to a secure page for "login" which users can click to enter their login account.