Error with my Login Authentication Servlet

Question

Please i have some doubt about my ConnectLogin and my ServletValidLogin: My ConnectLogin

    package br.com.cad.dao;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;

import br.com.cad.basica.Contato;
import br.com.cad.dao.ConnectDb;

public class ConnectLogin extends ConnectDb {

    public Contato getContato( String email, String senha ){

        Connection c = this.getConnection();
        PreparedStatement ps = null;
        ResultSet rs = null;
        try{


            ps = c.prepareStatement("select pf_email, pf_senha from dados_cadastro where pf_email = ? and pf_senha = ?");
            ps.setString(1, email);
            ps.setString(2, senha);

            rs = ps.executeQuery();

            if ( rs.next() ){
                Contato user = new Contato();
                user.setEmail(email);
                user.setSenha(senha);
                user.setNome( rs.getString("pf_nome") );

                return user;
            }
        }
        catch (SQLException e){
            e.printStackTrace();
        }
        finally{
            if (rs != null ) {
                try { rs.close(); } catch (SQLException e) { ; }
                rs = null;
            }
            if (ps != null ) {
                try { ps.close(); } catch (SQLException e) { ; }
                ps = null;
            }
            if (c != null ) {
                try { c.close(); } catch (SQLException e) { ; }
                c = null;
            }
        }
        return null;
    }
}

My Servlet:

package br.com.cad.servlet;

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import br.com.cad.dao.ConnectLogin;
import br.com.cad.basica.Contato;

public class ServletValidaLogin extends HttpServlet {

    private static final long serialVersionUID = 1L;

    protected void doPost(HttpServletRequest request, HttpServletResponse response)
                         throws ServletException, IOException{

        HttpSession session = request.getSession(); 
        Contato user = null;
        String email = request.getParameter("email"); 
        String senha = request.getParameter("password"); 

        try {
            ConnectLogin dao = new ConnectLogin(); 
            user = dao.getContato(email, senha);
        }
        catch ( Exception e ){

        }


        if ( user == null ) {
            session.invalidate();
            request.setAttribute("msg", "Usuário ou senha inválidos");
            request.getRequestDispatcher("login.jsp" ).forward(request, response);
        }
        else{

            session.setAttribute("user", user);
            request.getRequestDispatcher("home.jsp" ).forward(request, response);
        }

    }

}

And my ConnectDb:

    package br.com.cad.dao;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;


public class ConnectDb {  

    public Connection getConnection() {  
        try {  
            System.out.println("Connect to database...");  
            return DriverManager.getConnection("jdbc:mysql://localhost:3306/soa", "root", "wey123");  
        } catch(SQLException sqlException) {  
            throw new RuntimeException(sqlException);  
        }  
    }

I don't know what is wrong and why is returned in my console: Connect to database... in my webpage is returned user and password invalids! I think the problem is with my ConnectLogin but what?

Answer 1

I would look into Spring, and Spring Security, Spring offers good tested system to secure website and manage db connections.

Currently it supports DB-backed, JNDI-backed security or you can just hardcode users and roles. With spring you can secure just sections of the site or methods

Here is more info about security itself http://static.springsource.org/spring-security/site/tutorial.html

Answer 2

Your "bug" could be one of two things. It could be that you are not even connecting to the database. In ConnectDb.java you are throwing a RunTimeException but in ServletValidaLogin.java you are swallowing that exception. Add a System.out.println(e.getMessage()) in the catch block to make sure that you are indeed able to connect.

try {
    ConnectLogin dao = new ConnectLogin(); 
    user = dao.getContato(email, senha);
}
catch ( Exception e ){
    System.out.println(e.getMessage()); 
}

What will happen in this case is that since you are not connected, you will go to the catch block, then your if statement in ServletValidaLogin

if ( user == null )  

will evaluate to true and you will see your error message. Side note: You are catching a lot of exceptions without outputting/logging any of them. You should consider adding println statements in all of them. It will make it easier for you to debug.

If you are able to connect, then it could be that your ResultSet is not pointing to anything after you execute the query. If that's the case if ( rs.next() ) will evaluate to falsein ConnectLogin.java and your method will return null instead of a user. It could be that you have a bad query (not sure if you should be getting an error message though, I haven't use plain JDBC in a long time). In any case, access mysql directly and add a fake user and try your query on that dummy user. If you can find him than maybe your issue might be in your insertion (ok, so 3 possible causes).

UPDATE

It seems like your actual problem was that you were referencing the wrong name in your getRequest method for password. We determined that the name for attribute <input>was actually senha and made the necessary changes.

Note: Instead of

user.setEmail(email);
user.setSenha(senha);

It should be

user.setEmail(rs.getString("pf_email"));
user.setSenha(rs.getString("pf_senha"));

(although not completely necessary because of your ifcondition but it makes more sense to set them to what the query returns...at least for me).

Also,

user.setNome( rs.getString("pf_nome") );

should not even be here since it's not in your select statement.

Lastly (unrelated to your main problem), you should seriously consider synchronizing HttpSession. It is not thread safe. You can read the answer below to get started if you want to know why. There are many more articles on the web that talk about this.

Is HttpSession thread safe, are set/get Attribute thread safe operations?