HttpClient for Form Based Authentication

There are 3 HTTP requests: 1st one to visit the protected pages defined by security-constraint in web.xml and obtain JSESSIONID, this is becasue we cannot access to j_security_check directly; 2nd one to post j_security_check for authentication; 3rd one resubmit the original request. The subsequent requests in the same session will be authenticated automatically. The Key point is that the 3rd one must resubmit the exact same original request. This is because the state is kept in server and the following request (a redirect request) will be checked against it. The redirect is always a GET based on the LOCATION header value in the response (response code 302). So if you send POST request to a different URL in 3rd request, you maybe mysterously taken to a doGet() method instead although you issue a POST request, as what I observed in JBOSS environment. In Tomcat, the behaviour is different, it is treated as non-authenticated and taken to login page again. Also, keep in mind that redirect might result in previous POST data lost.

HttpClient client = new HttpClient();
GetMethod method = new GetMethod("http://localhost:8000/webTest/protected/securityTest.html");
int status = client.executeMethod(method);    // 200, response with login page
method.releaseConnection();

PostMethod authPost = new PostMethod("http://localhost:8000/webTest/j_security_check");
// authPost.setFollowRedirects(false);
NameValuePair[] data = {
    new NameValuePair("j_username", "tomcat"),
    new NameValuePair("j_password", "tomcat")
};
authPost.setRequestBody(data);
status = client.executeMethod(authPost);    // 302, redirect to original requested page
authPost.releaseConnection();

method = new GetMethod("http://localhost:8000/webTest/protected/securityTest.html");
client.executeMethod(method);
String response = method.getResponseBodyAsString();
method.releaseConnection();
System.out.println(response);