HTTP 403 when attempt to perform Action

Question

I've got an action on form

<form action="LoginAction.do" method="POST">
            <div id="table"
                class="ui-widget-header ui-corner-all ui-widget-content">
                <table align="center" style="width: 100%">
                    <tr>
                        <td align="center"><span
                            style="color: white; font-size: 20px;"><fmt:message
                                    key="lg" /></span></td>
                        <td align="right"><input type="text" id="login" name="login" />
                        <td>
                    </tr>
                    <tr>
                        <td align="center"><span
                            style="color: white; font-size: 20px;"><fmt:message
                                    key="paswd" /></span></td>
                        <td align="right"><input type="text" id="password"
                            name="password" /></td>
                    </tr>
                    <tr>
                        <td align="right" colspan="2"><input type="submit"
                            id="approve" style="font-size: 10px;"
                            value="<fmt:message key='enter'/>" /></td>
                    </tr>
                </table>
            </div>
        </form>

When I press the button It should perform LoginAction

HttpSession session = req.getSession();
log.debug("attempt to checkuser");
String page = req.getRequestURI();
String login = req.getParameter("login");
String password = req.getParameter("password");
loginService = new LoginServiceImpl();
if (loginService.checkExists(login, password)) {
     session.setAttribute("enterAttr", true);
     session.setAttribute("loginame", login);
     return page;
}
session.setAttribute("enterAttr", false);
return "redirect:" + page;

In ActionServet it should check the result of Action and then redirect to a certain page.

String name = getActionName(req);
Action action = (Action) factory.getAction(name, getClass()
            .getClassLoader());         
String view = action.exec(req, resp);
//router
if (view.startsWith("redirect:")) {
     resp.sendRedirect(view.substring("redirect:".length(),
                view.length()));
} else {
     getServletContext().getRequestDispatcher(
                "/WEB-INF/jsp/" + view + ".jsp").forward(req, resp);

}

But instead of it I've got HTTP Status 403 - Access to the requested resource has been denied when I try to press the button.

Where is the problem? Something with tomcat users?

Here is web.xml

<?xml version="1.0" encoding="Cp1251"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
version="2.5">

<context-param>
    <param-name>javax.servlet.jsp.jstl.fmt.localizationContext</param-name>
    <param-value>messages</param-value>
</context-param>

<servlet>
    <servlet-name>ActionServlet</servlet-name>
    <servlet-class>com.project.reservation.web.ActionServlet</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>ActionServlet</servlet-name>
    <url-pattern>*.do</url-pattern>
</servlet-mapping>

<security-role>
    <description>Role for administrator's actions</description>
    <role-name>admin</role-name>
</security-role>

<welcome-file-list>
    <welcome-file>/main.jsp</welcome-file>
</welcome-file-list>


<security-constraint>
    <web-resource-collection>
        <web-resource-name>reservation</web-resource-name>
        <url-pattern>*.do</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>NONE</transport-guarantee>
    </user-data-constraint>
</security-constraint>

Answer 1

You are implementing your own authentication mechanism but using containers web.xml file to specify security constraints. If I were you I could try to move my authentication code to a filter and remove security constraint from web.xml file.