How can I protect a JSP page after adding it to my hosting and make it live?

Question

I have a very simple JSP login that passes variables to a servlet and checks from a MySQL database if a username and password are available. Is it safe enough to use on a website, or is more security required? If so, how to make it safer?

This is the servlet:

import java.io.*;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.*;
import java.sql.*;

/**
 * Servlet implementation class loginServlet
*/
@WebServlet("/loginServlet")
public class loginServlet extends HttpServlet {

private static final long serialVersionUID = 1L;

/**
 * @seeHttpServlet#HttpServlet()
 */
public loginServlet() {
    super();
    // TODOAuto-generated constructor stub
}

/**
 * @seeHttpServlet#doGet(HttpServletRequest request, HttpServletResponse
 * response)
 */
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    // TODOAuto-generated method stub
}

/**
 * @seeHttpServlet#doPost(HttpServletRequest request, HttpServletResponse
 * response)
 */
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    HttpSession session = request.getSession();
    String email = request.getParameter("email");
    String pwd = request.getParameter("pass");
    try {
        Class.forName("com.mysql.jdbc.Driver");
        Connection con =
                DriverManager.getConnection("jdbc:mysql://localhost:3306/logindb",
                "root", "password");
        Statement st = con.createStatement();
        ResultSet rs;
        rs = st.executeQuery("select fname, lname, email from userAccount where Email='"
                + email + "' and password='" + pwd + "'");
        if (rs.next()) {
            session.setAttribute("email", email);
            session.setAttribute("Fullname", rs.getString(1) + " " + rs.getString(2));
            response.sendRedirect("success.jsp");
        } else {

            response.sendRedirect("fail.jsp");
        }
    } catch (Exception ssd) {
        System.out.println(ssd.getMessage());
    }
}
}

Answer 1

There are several security and programming issues with this code:

• if the application is not transmitted via HTTPS, the password passes through clear text over the network.
• . , , bcrypt. , , .
• , SQL-.
• stataments, , , .
• . , , . . . catch - .

Answer 2

-, ? , ?

. . form-based authentication, store password as hash . Spring Security. Spring Security.

• Spring
• OpenID
• (ACL)
• JDBC
• LDAP
• JSF GWT

Answer 3

:

• SQL Injection: , SQL-. , "; drop table userAccount;". .

  rs = st.executeQuery("select fname, lname, email from userAccount where Email='"+ email + "' and password='"+ pwd + "'");

• : try, . . fail.jsp .

• Capcha , .

Answer 4

, . , , sha256 (fooobar.com/questions/55480/...), , , .

st.executeQuery("select fname, lname, email from userAccount where Email='"+ email + "' and password='"+ sha256(pwd) + "'"); 

- sql, SQL-, , - ,

  "password; delete from users;"

sql users .

 dbConnection.prepareStatement("select fname, lname, email from userAccount where Email=? and password=?" );

sha256 ()

Answer 5

You definitely should not store crear passwords, so if you are hacked, the hacker does not receive passwords. You must digest them with an irreversible algorithm ( SHA-1 recommended) with salt. Salt is protection against rainbow tables .