security question

[Jonathan M Crater <jo...@fanniemae.com>]

i'm using weblogic 5.1, which does not allow RequestDispatching to JSPs underneath WEB-INF.  so i'm stuck keeping my JSPs outside WEB-INF.  as a result,
i have to secure requests to both JSPs and actions.  securing the actions is just a matter of sub-classing ActionServlet and providing logic to check for
certain secured paths.  the problem is i don't want to repeat the logic in the JSPs--either through a tag library or otherwise.  does anyone have any
suggestions as to how best to prevent a situation where a user requests a JSP page directly when it should have gone through the sub-classed
ActionServlet?  i was thinking of just setting a request parameter for each request as it passes through the ActionServlet.  that way, in the JSP i can
just test for that value to determine whether the request went through the proper channel.  if not, i can redirect to an error page.

thoughts?  suggestions?

Re: security question

[Ted Husted <hu...@apache.org>]

If all the JSP's are behind Actions, the problem is mitigated since the
names of the JSPs are not revealed on the address bar, only the Action
shows. 

One idea would be to generate a request token for each request that
comes through the Action. That could be a dual use features, since you
could use the same token to watch for duplicate submits. You might also
put "expects" check at the top of the JSPs that use any other attribute
in the request, and redirect them to the Action when the attribute is
missing. That documents what the JSP requires, and provides QA on top of
security.

-- Ted Husted, Husted dot Com, Fairport NY USA.
-- Custom Software ~ Technical Services.
-- Tel +1 716 737-3463
-- http://www.husted.com/about/struts/


Jonathan M Crater wrote:
> 
> i'm using weblogic 5.1, which does not allow RequestDispatching to JSPs underneath WEB-INF.  so i'm stuck keeping my JSPs outside WEB-INF.  as a result,
> i have to secure requests to both JSPs and actions.  securing the actions is just a matter of sub-classing ActionServlet and providing logic to check for
> certain secured paths.  the problem is i don't want to repeat the logic in the JSPs--either through a tag library or otherwise.  does anyone have any
> suggestions as to how best to prevent a situation where a user requests a JSP page directly when it should have gone through the sub-classed
> ActionServlet?  i was thinking of just setting a request parameter for each request as it passes through the ActionServlet.  that way, in the JSP i can
> just test for that value to determine whether the request went through the proper channel.  if not, i can redirect to an error page.
> 
> thoughts?  suggestions?