What methods can be used to protect (encrypt using Java code) the information in a login form before it is sent to a servlet for

One major concern I have involves sending encrypted data (encrypted before sending the request) to a servlet. I attempted to call a function that encrypts passwords as an example, but I encountered difficulty passing values from JavaScript to Java code in JSP.

<script>
function login() {
var password = document.getElementsByName("newPassword");
console.log(password);
}
</script>
</head>
<body>
<form class="login" action="servlet example" method="Post">
<h1 class="login-title">BSH Login</h1>
<h3><%=request.getAttribute("message") != null ? request.getAttribute("message") : ""%></h3>
<input type="text" class="login-input" name="username"
placeholder="Bsh UserName" autofocus> <input type="password"
name="passowrd" class="login-input" placeholder="Password"> <input
type="submit" value="Login" onclick="login()" class="login-button">
</form>

</body>

I am determined to find a way to securely send encrypted data from JSP to a servlet without using HTTPS.

Answer №1

To ensure a secure connection when sending login requests, it is crucial to utilize HTTPS. This protocol encrypts all data transmitted between the user's device and the server, eliminating the need for additional password encryption.


Now, consider the scenario where one attempts to use an insecure connection like HTTP instead of HTTPS. Is it feasible to employ encryption for securely transmitting passwords?

The answer appears to be negative.

In this hypothetical situation, let us designate Alice as the user, Bob as the server, and Carol as the potential eavesdropper attempting to intercept the password.

Imagine Alice sends an HTTP request to retrieve the login page from Bob, who responds with a page containing Javascript code that supposedly encrypts the password input by the user. Despite utilizing public key encryption in the Javascript, Carol could potentially decipher the password even without access to the encryption key. However, this approach is inherently insecure due to the fact that Bob sent the unencrypted page with the Javascript code to Alice's browser. Carol can leverage various network hacking methods to alter Bob's response, modifying the Javascript code received by Alice. As a result, the altered script might transmit the password in plaintext or encrypt it using an alternate key, leading to login failures or unauthorized password retrieval by Carol. If the login request itself is also transmitted over HTTP, Carol can manipulate the connection to force it onto an insecure path.

This scenario illustrates a vulnerability known as a "man-in-the-middle" (MITM) attack, emphasizing the necessity of conducting the entire transaction over HTTPS to safeguard against such exploits.

In summary, relying on security mechanisms within an insecure login page is insufficient protection, highlighting the importance of implementing end-to-end HTTPS encryption.

Answer №2

If you're looking to secure your web-based requests, I highly recommend utilizing JSON Web Tokens. You can access more information about them at this link: https://jwt.io.

By using this program/tool, you'll be able to securely embed encrypted data and ensure its authenticity when sending and receiving information (especially during the receiving process). Take some time to familiarize yourself with the documentation and incorporate it into either your Javascript or Java framework as needed.

Answer №3

It seems like your question could benefit from more clarity.

If you are looking to transfer any credentials or data from the client to the server, using HTTPS is the only secure option available.

When passing data from JSP to a servlet using the internal request dispatcher, it is locally secure and does not involve the client. However, if you need to redirect calls between gateways and involve the client in the process, HTTPS is still necessary for security purposes.

Similar questions

If you have not found the answer to your question or you are interested in this topic, then look at other similar questions below or use the search

Is there a way to resolve the execution order dependency of JS-CF using a server-side callback function?

Is there a way to display a form as a pop-up window, with input fields and a submit button, and then retrieve the user's selection from the session? The challenge lies in integrating JS code for the pop-up window with CF server-side code, leading to t ...

Struggling with integrating API response formatting in React and updating state with the data

This is the content found in the file 'Search.js' import React, { Component } from 'react'; import * as BooksAPI from './BooksAPI' class Search extends Component{ constructor(props){ super(props); this.state={ ...

What is the solution for the "NET::ERR_CERT_COMMON_NAME_INVALID" error in Selenium using Java?

I'm currently developing a project in Java with the integration of Selenium. I have made an attempt to write my test codes. Here is a snippet of my progress so far. AutoTest public class AutoTest { WebDriver driver = null; @BeforeTest public void s ...

Determine the RGB color values for specific coordinates within Adobe Illustrator

Currently exploring ExtendScript for JavaScript in Adobe Illustrator 2015. Is there a method to retrieve RGB values based on coordinates within the code below? // initializing document var doc = app.activeDocument; // defining x and y coordinates for colo ...

Has anyone attempted to create their own local device lab for automating mobile apps with Appium?

Setting up my own local device lab for testing Android apps has been on my mind lately. While I've used Saucelabs and Browser Stack in the past, I find them to be a bit too expensive for my liking. Has anyone here experimented with their own local de ...

Encountering a glitch with Firefox 51.0 while running Selenium 3.0.1

Recently starting to work with Selenium WebDriver. This is the code I have been using: import org.openqa.selenium.By; import org.openqa.selenium.WebDriver; import org.openqa.selenium.WebElement; import org.openqa.selenium.firefox.FirefoxDriver; import or ...

Finding the text within a textarea using jQuery

My journey with jQuery has just begun, and following a few tutorials has made me feel somewhat proficient in using it. I had this cool idea to create a 'console' on my webpage where users can press the ` key (similar to FPS games) to send Ajax re ...

Getting a surprise image from the collection

I am experiencing an issue with retrieving images from an array. I have an array containing 6 variables that represent the paths to the images. However, when I use console.log at the end, it returns a random variable like sk11, sk15, etc., which do not c ...

Ways to troubleshoot and verify values in PHP that are sent through AJAX

In my jQuery function, I am using AJAX to send values to a PHP file: $.ajax({ //make ajax request to cart_process.php url: "cart_process.php", type: "POST", dataType: "json", //expect json value from server data: { quantity: iqty, ...

The detailed record of this run can be accessed at:

npm ERR! code ENOTEMPTY npm ERR! syscall rename npm ERR! path /usr/local/lib/node_modules/expo-cli npm ERR! dest /usr/local/lib/node_modules/.expo-cli-dKBr48UN npm ERR! errno -39 npm ERR! ENOTEMPTY: The directory cannot be renamed because ...

Ensure that you wait for the completion of the download process in Selenium Webdriver using

After clicking a download button, the files will start to download. In order to ensure that the next code is executed only after the download is complete, we need to find a way to make the webdriver wait. The current code structure looks like this: Threa ...

What is the best way to transfer properties to a different component using the onClick event triggered by an element generated within the map function?

I am currently working on an application using react to retrieve data from a mongodb database. Within one of the components, called Gallery, I have integrated a map function to display a list of items. My goal is to implement an onClick event for each elem ...

Include a .done() callback within a customized function

In the small class, I have included these functions: var Ajax = { // Send new entry data to database endNewEntry: function (json) { $.post("/controllers/insertEntry.ajax.php", {"json": json}); }, loadView: function (view, target, extra) { ...

The error message "TypeError: Unable to access property of undefined when using web sockets"

Exploring Isomorphic framework for React and integrating Pusher for websockets communication. I'm encountering difficulty accessing the state within the componentDidMount() function. class TopbarNotification extends Component { state = { vis ...

Unable to use NodeJS await/async within an object

I'm currently developing a validation module using nodeJs and I'm facing difficulties understanding why the async/await feature is not functioning correctly in my current module. Within this module, I need to have multiple exports for validation ...

Preventing Shift: How to Only Replace the Chosen Vue Draggable Item Without Affecting Other Grid Items

Let's try an example to demonstrate: https://codesandbox.io/s/j4vn761455?file=/src/App.vue:112-116 Step 1: Drag item 4 to where 5 is. Notice how 4 and 5 switch positions. Step 2: Now, drag item 1 to position 6. Watch as 1 moves to where 6 was, pushi ...

Is there a way to narrow down Drive API list results based on a specific domain that has write permission?

I am currently working on retrieving a list of files from the drive API using a service account, with permissions granted to a specific domain for editing. While I have successfully implemented this feature for individual emails, I am facing a challenge in ...

Numerous volume sliders catering to individual audio players

I'm currently working on implementing volume sliders for multiple audio players, similar to what you can find on . With the help of Deepak, I've managed to create code that allows me to control play/pause and adjust the volume of various audio pl ...

Mastering the onKeyPress event for Material UI text fields: A step-by-step guide

I have a TextField component from Material UI as shown below: <TextField id="todo-textarea" label="Enter new todo" placeholder="ToDo" onChange={this.props.toDoOnChange} onKeyPress={(ev) => { ...

The Google Books API initially displays only 10 results. To ensure that all results are shown, we can implement iteration to increment the startIndex until all results have

function bookSearch() { var search = document.getElementById('search').value document.getElementById('results').innerHTML = "" console.log(search) var startIndex = I have a requirement to continuously make Ajax calls ...