4

I am trying to build a web application using html and javascript from which I want to login to geoserver hosted at: https://weaveprod.ucdp.utah.edu/geoserver/web/ I have written the following code for authentication using javascript.But it is always giving login failed.Kindly help me out.

HTML code:

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Untitled Document</title>
<script src="//code.jquery.com/jquery-1.10.2.js"></script>
<link rel="stylesheet" type="text/css" href="login.css">
<script type="text/javascript" src="login_auth.js" ></script>
<script type="text/javascript">
var option;
option = {
    user: "****",
    password: "****",
    server: 'https://weaveprod.ucdp.utah.edu/geoserver/web/?wicket:bookmarkablePage=:org.geoserver.web.GeoServerLoginPage',
    success: function () {
        alert("Login OK!");
    },
    failure: function () {
        alert("Login fail!");
    }
};
</script>

</head>
<body>
<!-- Begin Page Content -->
<div id="container">
<form>
    <label for="username">Username:</label>
    <input type="text" id="username" name="username">
    <label for="password">Password:</label>
    <input type="password" id="password" name="password">

    <div id="lower">
        <input type="checkbox" id="checkbox" name="checkbox"><label class="check" for="checkbox">Keep me logged
        in</label>
        <input type="submit" value="Login" onclick="login(option)">
    </div>
    <!--/ lower-->
</form>
</div><!--/ container-->
<!-- End Page Content -->
</body>
</html>  

Javascript code:

function login (options) {
// url del servlet del geoserver
var url = options.server;
// parametros para el login
params = "username=" + options["user"] + "&password=" + options["password"];

var contentType = "application/x-www-form-urlencoded";
//se inicializa la petición ajax
var ajax = $.ajax({
    data : params,
    type : "GET",
    crossDomain: true,
    dataType: "jsonp",
    contentType : contentType,
    url : url
});
// se ejecuta cuando la peticion finaliza
ajax.done(function() {

    if ($.cookie("JSESSIONID") != null && options && options.success) {
        options.success();
    }
});
// si ocurrio un error al realizar la peticion
ajax.fail(function() {
    if (options && options.failure) {
        options.failure();
    }
});
// se ejecuta siempre al final de la petición, sin importar que esta
// haya fallado
ajax.always(function() {
    if (options && options.always) {
        options.always();
    }
});
};

NOTE: Earlier in the javascript code, I used a POST request.But it is still giving a login failed message.The webpage and the server are in different domains and I do not have access to the source code of the server.

Thanks, Sayan

2

There are some security issues here.

I guess the reason you got the "different domain" message is because of the same origin policy, which is something browsers enforce to ensure that javascript does not execute scrips coming from other sites than the one you are currently on. This is mitigating the possibility of XSS (google it).

The second "issue" I see for you here is that you store the password in cleartext in javascript. It is fairly simple for an attacker to find the geoserver username/password then, all one needs to do is to take a short look at the javascript code that you send out (and yes, anyone can do that). Of course, I assume that only authenticated and authorized users will get this code sendt to their browsers? Do you also use ssl to prevent sniffing of the password?

  • I will not hard code the username and password in the javascript code.This code is for testing.If it works, then username and password will come from the login form.But, how do I resolve this issue of login failure? The issues regarding using ssl for password sniffing will come much later.Right now, I cannot simply login to geoserver. Kindly help me out !! – user2284140 Feb 18 '14 at 19:29
  • I'd guess by installing a proxy on your web server so that the login-request goes through it, and therefore circumvent the same origin policy. Or take a look here: stackoverflow.com/questions/3076414/… I'm not entirely sure its the sop that is the problem though, but its my best guess. – Plux Feb 19 '14 at 12:12
0

See if this this answer may help. Basically, you can avoid the same-origin problem without doing an explicit login by performing a wms request for a layer under authentication as a "login function".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.