Question concerning login.jsp

[Brewer, Edward L]

>>Thanks, that was the ticket.  Here is the solution to our problem
>>
>>In the login.jsp we included this javascript

>Umm, I don't want to alarm you, but that looks like a XSS attack waiting to happen. You shouldn't be controlling the form action with something that can be fed in externally.

Scott,

Alarm away.  That is the reason I posted here before I went live in production.  I am a little confused on how someone can exploit this however (maybe from my lack of html scripting experience).  Are you saying that someone could send a parameter that was crafted as a script that would be run on the server side?   If so what would stop them from doing that on login.jsp?  Is the reason because actionUrl is gotten through request.getAttribute vice request.getParameter.  I was going to just hardcode it to automatically POST to the login usernamePassword but I was worried that if it were really null.. say if someone just directed themselves to login.jsp, that it would crash the IdP trying to post username and password  to null instead of going to the j_security.

Thanks again,
Lee Brewer