You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Takfung Chan <da...@comcast.net> on 2003/06/19 18:10:16 UTC
block direct access to JSP files
Hi,
I have a Struts based application and would like to block all direct
access to JSP files by user, so if a user typing a URL point to a JSP
file directly, it will fail. I did a change to web.xml but not working
on Websphere 4.0.3 (I should post to websphere news group but I hope
some one here already did the same thing)
here is my web.xml config relate to this web resource protection, It
works fine on tomcat, but never in Websphere, any idea?
<security-constraint>
<web-resource-collection>
<web-resource-name>blockJSPDirectAccess</web-resource-
name>
<description>to block JSP direct access</description>
<url-pattern>*.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<description></description>
<role-name></role-name>
</auth-constraint>
</security-constraint>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: block direct access to JSP files
Posted by Emmanuel Feller <Em...@free.fr>.
Hi,
You may put all your jsp under the WEB-INF directory, so
they are not available for user. But the application still
work, because all navigation is done by the struts
controler. It is simple and work fine with all app server.
You must change your struts-config.xml to reflect the
changes of target for all your forward. It should be done by
find/replace ...
Regards,
Emmanuel
----- Message d'origine -----
De : "Takfung Chan" <da...@comcast.net>
� : "Struts Users Mailing List"
<st...@jakarta.apache.org>
Envoy� : jeudi 19 juin 2003 18:10
Objet : block direct access to JSP files
> Hi,
> I have a Struts based application and would like to block
all direct
> access to JSP files by user, so if a user typing a URL
point to a JSP
> file directly, it will fail. I did a change to web.xml but
not working
> on Websphere 4.0.3 (I should post to websphere news group
but I hope
> some one here already did the same thing)
> here is my web.xml config relate to this web resource
protection, It
> works fine on tomcat, but never in Websphere, any idea?
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>blockJSPDirectAccess</web-resource-
> name>
> <description>to block JSP direct access</description>
> <url-pattern>*.jsp</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <description></description>
> <role-name></role-name>
> </auth-constraint>
> </security-constraint>
>
>
>
>
> ----------------------------------------------------------
-----------
> To unsubscribe, e-mail:
struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail:
struts-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: block direct access to JSP files
Posted by Ted Husted <hu...@apache.org>.
I sometimes setup a security constraint (like the others shown on this
thread) to block access to JSPs -- thought, not to block access from
users but to block access from page authors!
If your application is following the Struts best practice of putting all
JSPs behind actions, your users never learn where the JSPs are. The
only URLs they see on their address line are .do's (or .html's if you
are using statics).
For the site welcome page, I usually use a HTML refresh instead. Seems a
little slower than a JSP, but it perserves the "no JSP rule".
<html><head><META HTTP-EQUIV="Refresh" CONTENT="0;URL=./Welcome.do">
</head><body></body></html>
-Ted.
Takfung Chan wrote:
> Hi,
> I have a Struts based application and would like to block all direct
> access to JSP files by user, so if a user typing a URL point to a JSP
> file directly, it will fail. I did a change to web.xml but not working
> on Websphere 4.0.3 (I should post to websphere news group but I hope
> some one here already did the same thing)
> here is my web.xml config relate to this web resource protection, It
> works fine on tomcat, but never in Websphere, any idea?
>
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>blockJSPDirectAccess</web-resource-
> name>
> <description>to block JSP direct access</description>
> <url-pattern>*.jsp</url-pattern>
> </web-resource-collection>
> <auth-constraint>
> <description></description>
> <role-name></role-name>
> </auth-constraint>
> </security-constraint>
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: struts-user-help@jakarta.apache.org
>
>
--
Ted Husted,
Struts in Action <http://husted.com/struts/book.html>
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org