MVC security?

[Daniel Jimenez <Ji...@basco.com>]

This issue has probably already been covered but if someone could lend me a hand in describing any security benefits of having an MVC framework.

I'm not a security expert by any means, but my gut reaction is that the struts framework provides some increase in security.  Could someone respond back and describe what they are or aren't?

Thanks in advance!!
Dan Jimenez
Briggs & Stratton




--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: MVC security?

[Peter Georgiou <pe...@btinternet.com>]

Struts does allow you to place all your files including jsp files under the
web-inf directory, and therefore make them much more difficult for outsiders
to view.  You also don't have to give the name of the jsp file you want to
access from a form submission/link.

action="someJsp.do"

in the struts-config.xml script:

<action path="/someJsp"
       forward="/web-inf/jsp/aJspFile.jsp"/>

Hope this helps

Peter

----- Original Message -----
From: Daniel Jimenez <Ji...@basco.com>
To: <st...@jakarta.apache.org>
Cc: Steve Goldsmith <Go...@basco.com>
Sent: Monday, November 26, 2001 10:29 PM
Subject: MVC security?



This issue has probably already been covered but if someone could lend me a
hand in describing any security benefits of having an MVC framework.

I'm not a security expert by any means, but my gut reaction is that the
struts framework provides some increase in security.  Could someone respond
back and describe what they are or aren't?

Thanks in advance!!
Dan Jimenez
Briggs & Stratton




--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: MVC security?

[Ted Husted <hu...@apache.org>]

In addition to what is normally available to Java Servlets, you can also
design your application so that all requests pass through the controller
first. This gives you an opportunity to vet each request before it is
handled, or forwarded out to a JSP. Also, a tiered design can serve as a
firewall between HTTP and the business end of your application, so that
your business objects are not accessible by HTTP. The request goes to
the controller, who can mediate any security concerns, and then decide
whether or not to send the data out to a  JSP. This also means that Web
designers can't inadvertently disable security by breaking some
scriptlet. If the user is not authorized, the data is neither retrieved
nor handed to the JSP.


-- Ted Husted, Husted dot Com, Fairport NY USA.
-- Custom Software ~ Technical Services.
-- Tel +1 716 737-3463
-- http://www.husted.com/struts/


Daniel Jimenez wrote:
> 
> This issue has probably already been covered but if someone could lend me a hand in describing any security benefits of having an MVC framework.
> 
> I'm not a security expert by any means, but my gut reaction is that the struts framework provides some increase in security.  Could someone respond back and describe what they are or aren't?
> 
> Thanks in advance!!
> Dan Jimenez
> Briggs & Stratton
> 
> --
> To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>