Asynchronous java script and XML (AJAX) form-based authentication using java 2 platform enterprise edition (J2EE)

An apparatus, system, and method are disclosed for Asynchronous Java Script and XML (AJAX) form-based authentication using Java 2 Platform Enterprise Edition (J2EE). The apparatus for AJAX form-based authentication using J2EE is provided with a plurality of modules configured to functionally execute the necessary steps for redirecting an AJAX client request to an authentication required servlet, issuing an AJAX response to the client, authenticate the user security credentials, and process the client request for secure data. In addition, a method of the present invention is also presented for programming Asynchronous Java Script and XML (AJAX) form-based authentication that avoids a page change using Java 2 Platform Enterprise Edition (J2EE).

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to form-based authentication and more particularly relates to Asynchronous Java Script and XML (AJAX) form-based authentication using Java 2 Platform Enterprise Edition (J2EE).

2. Description of the Related Art

AJAX is a collection of technologies that give the web a dynamic capability lacking with standard web applications using Hyper Text Markup Language (HTML) pages interfaced with a server. Standard web applications require a page change or refresh to send information to the server in the form of a Hypertext Transfer Protocol (HTTP) request. Therefore, the user often interacts with a web page while the web page remains idle, not in communication with the server. It is only when the user activates a page change through a button or other method that the application interacts with the server. Meanwhile, the user sees the page change or refresh as the information is submitted and then returned by the server.

AJAX, conversely, allows server interaction without a page change, providing “asynchronous” data exchange between an idle web page and a server, thereby not affecting the display of the current webpage or browser behavior. This asynchronous exchange is made possible by Java Script code that connects with the server, sending and receiving data by the use of the XMLHttpRequest (XHR) object built into newer browsers. XHR requests often transfer data in the form of Extensible Markup Language (XML), HTML, plain text, or a Java Script Object Notation (JSON) object. Furthermore, a server-side technology such as ASP or J2EE is typically required with AJAX applications.

The authentication implementations available for AJAX web applications using J2EE webcontainers include Basic, Form, and Digest. Basic is most often used due to incompatibility issues with Form authentication and AJAX/J2EE applications. However, Basic authentication has several disadvantages including: no control over the authentication dialog displayed to the user, the password is encrypted with a simple and weak algorithm and stored in the request header, thereby requiring all requests to be made in HTTPS connections, and no reliable way is provided for the user to log off.

SUMMARY OF THE INVENTION

The present invention has been developed to provide an apparatus, system, and method for asynchronous AJAX form-based authentication using J2EE.

The apparatus for AJAX form-based authentication using J2EE is provided with a plurality of modules configured to functionally execute the necessary steps for redirecting an AJAX client request, issuing an AJAX response to the client, authenticating the user security credentials, and processing the client request. These modules in the described embodiments include a redirection module, a response module, an authentication module, and a processing module.

The redirection module, in one embodiment, redirects an AJAX client request to an authentication required servlet in response to detecting a client request for secure data. Also, the response module may issue an AJAX response to the client, the AJAX response directing the client to obtain user security credentials. In addition, the client may prompt a user for the user security credentials independent of a server-based security credential form. Also, the authentication module may authenticate the user security credentials using a web container authentication service, the user security credentials received by way of an AJAX form-based authentication request. Finally, the processing module may process the client request for secure data in response to a positive authentication of the user security credentials.

The processing module, in one embodiment, passes the authentication result to an authentication failed servlet in response to a rejection of the user security credentials. Also, the authentication failed servlet returns an AJAX response to the client comprising an authentication failure message and the client may indicates a security credential failure message. In another embodiment, the apparatus further comprises an invalidation module that redirects an AJAX logoff request to a session invalidation servlet, the session invalidation servlet invalidates a session object associated with the AJAX logoff request. The web container authentication service may also comprise a Java 2 Platform Enterprise Edition (J2EE) web container authentication service.

The AJAX form-based authentication request may, in one embodiment, comprise an XMLHttpRequest (XHR) request to a standard J2EE form-based Uniform Resource Locator (URL) “j_security_check,” the XHR request comprising a user identification in a POST parameter named “j_username” and a user password in a POST parameter named “j_password.” Additionally, the authentication failed servlet may return a Java Script Object Notation (JSON) object configured to indicate that authentication has failed. Furthermore, the authentication required servlet may also return a Java Script Object Notation (JSON) object indicating that authentication is required.

A computer program product is also presented for asynchronous AJAX form-based authentication using J2EE. Moreover, the computer program product performs the necessary steps as described above in relation to the apparatus. A system of the present invention is also presented for asynchronous AJAX form-based authentication using J2EE. The system may be embodied as a network to communicate data between a plurality of devices and a client in communication with the network. The client may send an AJAX request for secure data and prompt a user for user security credentials. The client may also manage one of a positive and a negative response from a form-based authentication submission. In addition, a server may be in communication with the network. Furthermore, the system also has the functionality described above in relation to the operation of the described apparatus.

A method of the present invention is also presented for programming Asynchronous Java Script and XML (AJAX) form-based authentication that avoids a page change using Java 2 Platform Enterprise Edition (J2EE). In one embodiment, the method includes defining security constraints in a web application deployment descriptor file on a web server, the deployment descriptor file designating secure requests for data. Furthermore, the method may include enabling form-based authentication in the web application deployment descriptor file on the web server. The deployment descriptor file may include a “form-login-config” element with a “authrequired” element registered to a first Uniform Resource Locator (URL) and an “authfailed” element registered to a second URL. The method may also include associating an “authrequired” servlet with the first URL and an “authfailed” servlet with the second URL. The “authrequired” servlet indicates that authentication is required and the “authfailed” servlet indicates that a login attempt has failed. Additionally, the method may include writing an AJAX request to a form-based Uniform Resource Locator (URL) labeled “j_security_check.” The AJAX request may be written in Java Script and may pass a user-entered user identifier in a POST parameter labeled “j_username” and the user-entered password in a POST parameter labeled “j_password.” Furthermore, the method may also define a callback handler on the client to manage a successful or unsuccessful authentication.

In one embodiment, the method includes writing an AJAX request in Java Script on the client to an invalidation Uniform Resource Locator (URL) registered to an “invalidation” servlet. The “invalidation” servlet calls HttpServletRequest.getSession( ).invalidate( ) to invalidate the user's session object. Furthermore, the “authrequired” servlet return message may comprise a JSON object. In addition, the “authfailed” servlet return message may also comprise a JSON object.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1illustrates one embodiment of a system100for asynchronous AJAX form-based authentication using J2EE. The system100includes a client102with an AJAX Client Side Handler108, a network104, and a server106with an AJAX J2EE Form-Based Authenticator110. Those of skill in the art recognize that the system100may be simpler or more complex than illustrated, so long as the system100includes modules or sub-systems that correspond to those described herein.

In one embodiment, the client102may comprise a software web browser such as Internet Explorer or Mozilla Firefox with XHR object and Java Script functionality. In addition, the client102may comprise an operating system such as Windows or Linux capable of executing the required web browser. The AJAX Client Side Handler108on the client102may include a browser running the client side of an AJAX-enabled web application. The code on the client side may consist of AJAX Java Script code capable of making asynchronous XHR requests to transfer data. The AJAX Client Side Handler108may also prompt a user for user security credentials in response to a message from the server106requiring authentication, or display a message that authentication has failed in response to a corresponding message from the server106.

To implement the form-based authenticator, the server106may run a web server application which uses J2EE Web Containers. In addition, the server106may contain a web application deployment descriptor file configured to designate secure requests for data. This file may be a standard web.xml file located on the server side of many web applications. Furthermore, form-based authentication may be enabled in the file along with an “authrequired” URL and an “authfailed” URL. In addition, instances of secure data may also be designated in the file. For instance, all URLs ending or containing a certain path such as “/secure/” may be designated as secure and requiring authentication. Advantageously, the J2EE Web Containers will redirect any requests to these URLs to the appropriate authentication URL if authentication has not yet been performed. Along with the required URLs, corresponding servlets may be written, compiled to the server106, and associated with these URLs. A method for programmatically implementing one embodiment of these server106modifications will be discussed below.

FIG. 2illustrates one embodiment of an apparatus200for asynchronous AJAX form-based authentication using J2EE. The apparatus200depicts one embodiment of AJAX J2EE Form-Based Authenticator110located on the server106and includes a redirection module202, a response module204, an authentication module206, and a processing module208. In one embodiment, the redirection module202detects an AJAX client request for secure data and redirects the request to an authentication required servlet. The operations of the redirection module202may be performed by J2EE Web Containers which automatically redirects URLs that have been designated as being secure in the web.xml as described above. In this manner, embodiments of the present invention leverage the authentication and redirection capabilities of the J2EE Web Containers while obtaining the benefits of a client-side authentication interface and no page change on the client side to obtain authentication credentials. The response module204is issues an AJAX response by way of the authentication servlet to the client102directing the client102to obtain user security credentials. In one embodiment, the authentication required servlet returns a JSON object to the client102to indicate that authentication is required. A JSON object is a text-based representation of a data type. However, the servlet may also return a response using XML, plain text, or any other suitable format.

The user security credentials may consist of a username and password, Personal Identification Number (PIN) number, social security number, or any other form of unique identifier that may be used by a web application. In one embodiment, upon receiving this response from the server106, the client102prompts a user for her user security credentials independent of a server-based security credential form. Therefore, while the client side application may use form-based security protocols, no actual form is used on the server side. In addition, form-based authentication allows greater customization on the client side over the authentication dialog displayed to the user.

The authentication module206authenticates the user security credentials using a web container authentication service. The authentication module206first receives the credentials by way of an AJAX form-based authentication request. In some embodiments, the web container authentication service comprises a Java 2 Platform Enterprise Edition (J2EE) web container authentication service. Furthermore, the AJAX form-based authentication request may comprise an XHR request to a required J2EE form-based URL “j_security_check.” In addition, the XHR request may send the user identification in a POST parameter named “j_username” and may send the user password in a POST parameter named “j_password.” Using these parameter names, the authentication module206simulates a conventional form submission.

The processing module208the client request for secure data in response to a positive authentication of the user security credentials. Furthermore, because form-based authentication does not actually store the password in the HTTP headers there is more flexibility to use regular HTTP requests once the authentication has been successful. Once the user has been successfully authenticated, the secure data may be sent to the client102with AJAX using an XHR request without a page change as discussed above. In addition, because form-based authentication does not actually store the password in the HTTP headers, there is more flexibility to use standard HTTP requests once the authentication has been successful. If the user security credentials are invalid, however, the processing module208passes the authentication result to an authentication failed servlet in response to a rejection of these credentials. In turn, the authentication failed servlet returns an AJAX response to the client102comprising an authentication failure message, the client102configured to indicate a security credential failure message. In one embodiment, the authentication failed servlet returns a JSON object to indicate that authentication has failed. However, the servlet may also return a response using XML, plain text, or any other suitable format.

FIG. 3illustrates another embodiment of an apparatus300for asynchronous AJAX form-based authentication using J2EE. The apparatus300includes the redirection module202, a response module204, an authentication module206, and a processing module208, wherein these modules include substantially the same features as described above with relation toFIG. 2.

Additionally, the apparatus300may contain an invalidation module302. The invalidation module302may redirect an AJAX logoff request to a session invalidation servlet. This servlet invalidates a session object associated with the AJAX logoff request. This module allows a user to logoff, a feature possible with only with form-based authentication. For example, a user using a computer in a public place and logged onto an ecommerce website, may wish to logoff to prevent others from accessing his ecommerce account. The user may click an onscreen button or menu selection which causes the client102to send an AJAX logoff request. The logoff request is redirected to a session invalidation servlet which invalidates the user's session and prevents others from accessing his account. Unlike non-AJAX web applications, no page change occurs during the logoff process.

FIG. 4illustrates one embodiment of a method400for asynchronous AJAX form-based authentication using J2EE. The method400may be implemented by the executed operations of a computer program product. The method400or operation may start402when the redirection module202redirects404an AJAX client request for secure data to an authentication required servlet. The response module204then issues406an AJAX response to the client102directing the client102to obtain user security credentials. In one embodiment, if the authentication module206makes a positive authentication408of the user security credentials, the processing module208processes410the client request for secure data and the method400or operation ends414. Alternatively, the authentication module206may reject408the user security credentials. The processing module208then may pass412the authentication result to an authentication failed servlet and the method ends414.

For example, the redirection module202of a bank account website redirects404an AJAX client request to access sensitive financial data to an authentication required servlet. The response module204issues406an AJAX response through the authentication required servlet to the client102to obtain the user's name and password. The authentication module206makes a positive identification408of the name and password using a J2EE web container authentication service and the processing module208processes410the client request for the financial information, allowing the financial information to be requested by the client102.

FIG. 5illustrates a detailed embodiment of a method500for asynchronous AJAX form-based authentication using J2EE. The method500may also be implemented by the executed operations of a computer program product. The method500or operation starts502when a client102requests504secure data from the server106. The redirection module202detects506the client request for secure data and redirect508the request to an authentication required servlet. The redirection508may be performed by J2EE Web Containers as configured by the web.xml file. Next, the response module204issues510an AJAX response to the client102, directing the client102to obtain user security credentials. The client102receives512this AJAX response from the server106and prompts514the user for the user security credentials. The client102may prompt514the user with standard HTML code, Java Script, Java code, or other similar programming methods.

Next, the client102sends the user security credentials516to the server106by way of an AJAX form-based authentication request. The server106receives518the user security credentials by way of the request. In one embodiment, if the authentication module206makes a positive authentication520of the user security credentials, the processing module208processes530the client request for secure data. After a user has been authenticated, he may access secure data until such time as he wishes to logoff. In some embodiments, to logoff, the client102sends532an AJAX logoff request. The invalidation module302redirects534the logoff request to a session invalidation servlet which invalidates536the session object, logs the user off, and the method500or operation ends538.

Alternatively, if the authentication module206rejects520the user security credentials, the processing module208redirects522the authentication result to an authentication failed servlet. Next, the authentication failed servlet returns524an AJAX response to the client102comprising an authentication failure message. Finally, the client102receives526the AJAX response, indicates528a security credential failure message, and the method500or operation ends538.

For example, a user may wish to access her shopping cart on an ecommerce website which uses AJAX and J2EE. The user selects an HTML button to view her shopping cart. The client102makes an XHR request504for the shopping cart data from the server106. The shopping cart pages have been marked as secure in the web.xml file on the server106. The redirection module202detects506the client request for pages marked as secure and redirects508the request to an authentication required servlet. The response module204issues510an XHR response to the client102, directing the client102to obtain user security credentials. The client102receives512this XHR response and prompts514the user for her user name and password using a customized dialog box. The user enters her information and again selects an HTML button. The client102sends516the user name and password using another XHR request. The server106receives518the user name and password by way of the request, makes a positive authentication520of the user name and password, and the processing module208processes530the client request for secure data. The user views her shopping cart and then presses an HTML button to log off. The client102sends532an AJAX logoff request, the invalidation module302redirects534the logoff request to a session invalidation servlet which invalidates536the session object and logs the user off. To the user, the entire transaction has occurred without a page refresh, as all data was exchanged using AJAX XHR requests “behind the scenes.”

FIG. 6illustrates one embodiment of a method600for programming AJAX form-based authentication that avoids a page change using J2EE. It will be appreciated by those skilled in the art that other code configurations may be used in place of the following examples. Beneficially, form-based AJAX authentication may be enabled on a client and server without major application or code changes. Furthermore, the method of implementing these changes is highly flexible. One such method600starts602by defining604security constraints in a web application deployment descriptor file on a web server. This file may be a standard web.xml file, and may be configured to designate secure requests for data. For example, the following web.xml sample shows defined security constraints:

EXAMPLE CODE 1

In the web application pertaining to the above example, all URLs with the path containing “/secure/” followed by the file name, will be treated as secure by the application and will require authentication.

Next, the method600then enables606form-based authentication in the N web.xml. This may be done by including a “form-login-config” element with a “authrequired” element registered to a first URL and an “authfailed” element registered to a second URL as follows:

EXAMPLE CODE 2

Next, “authrequired” and “authfailed” servlets are created 608 to be called in case of the need to authenticate or the failure to authenticate respectively. The authrequired servlet is associated with the first URL and an authfailed servlet is associated with the second URL in the web.xml file. Furthermore, the authrequired servlet may be configured to notify the client102that authentication is required. The authrequired servlet may notify the client102by means of a return message in the form of a Java Script Object Notation (JSON) object. The servlet may be configured as follows:

EXAMPLE CODE 3

In addition, the authfailed servlet may be configured to indicate that a login attempt has failed. The authfailed servlet may also notify the client102by means of a return message in the form of a Java Script Object Notation (JSON) object. The servlet may be configured as follows:

EXAMPLE CODE 4

In one embodiment, the method600includes writing610an AJAX request to a form-based URL labeled “j_security_check.” In this manner, the AJAX application simulates a standard form-based submission, while still allowing asynchronous data communication. Any standard HTML code to input user credentials may be used such as:

EXAMPLE CODE 5

The AJAX request to pass the user credentials consists of: a user-entered user identifier in a POST parameter labeled “j_username” and the user-entered password in a POST parameter labeled “j_password.” The client side Java Script code may be programmed as follows, having been called in a function shown above named “formlogin( )”:

EXAMPLE CODE 6

In another embodiment, the method includes then defining612a callback handler on the client side application configured to manage a successful or unsuccessful authentication. The client102is programmed to expect a response from the authrequired servlet and prompt the user for a user id and password. The client102may also be programmed to expect a response from the authfailed servlet and re-prompt the user for a user id and password, or report that the user credentials have failed.

In some embodiments, the method600includes creating614an “invalidation” servlet. This may include inserting an AJAX request in Java Script on the client102to an invalidation URL registered to the servlet in a similar manner as described above in relation to the authrequired and authfailed servlets. The invalidation servlet may log the user off by invalidating the user's session object. This may be performed functionally by calling the method HttpServletRequest.getSession( ).invalidate( ) in the invalidation servlet. One embodiment of an invalidation servlet is as follows:

EXAMPLE CODE 7

After the invalidation servlet has been created, the method600ends616.