Filter
Top Products
Fortinet 223 FortiWeb 5.0 Patch 6 Administration Guide
Figure 33:An authentication form on the Fortinet Technical Support login web page
This method does not rely on the mechanism defined in the HTTP protocol. Instead, when the
user submits the form, the web application uses form inputs to construct server-side sessions,
client-side session cookies, or parameters in the URL such as JSPSESSIONID in order to
create statefulness.
This type of authorization occurs at the web application layer of the server’s software stack. As
a result
, when visiting different web applications on the same host, users may have to
authenticate multiple times, unless the web applications share a single sign-on (SSO)
framework.
Authorization for each subsequent requested URL then occurs based upon whether the user is
in the logg
ed-in state, or the logged-out state, and possibly other implemented conditions such
as user groups and permissions. Dynamic page content may change based upon knowledge of
the user’s preferences. In addition to a logout button, this method also often adds session
timeouts. However, depending on the implementation, it often may only work properly if the
client supports — and accepts — cookies.
Accounting, if any, of this type of authentication
is ha
ndled by the web application or servlet.
This type of authentication cannot be offloaded to FortiWeb, but can be pr
otected using its
features. For example, you can use FortiWeb to enforce complex passwords by applying an