Securing a WebStack Application

Making sure that Web applications are "secure" involves many different aspects of application design, deployment and administration. This document covers only the usage of the authentication features of the WebStack API.

Authentication in WebStack

There are two principal methods of introducing authentication and applying access control to WebStack applications:

Here is a comparison of the features of these mechanisms:

Application-Wide Authenticators LoginRedirect and Login Modules
Deployment Some Web server configuration required.
Application only requires an additional object for authentication.
An additional login application or resource must be deployed.
Flexibility Possibly inflexible user experience - users may only get the login dialogue; probably no logout function.
HTTP-style authentication is well understood and supported when automating client access.
The login and logout activities can be customised to suit the appearance of the rest of the application.
Many applications can share the same login application, providing a "single sign-on" experience and potentially reduced administrative overhead.