CODEWITHSUNDEEP
securityauthenticationtomcat
SyAu
SyAu

Reputation: 1681

Tomcat 7 - Secure a folder under webapps folder

My web application is 'myweb', within this web app my code refers '123.pdf' under 'files' folder like http://localhost:8080/files/123.pdf 

   webapps  
   |  
   |--myweb  
   |  
   |--files  
       |  
       |--123.pdf

I want the resource (123.pdf) available only for logged in users, when I try to access directly by pasting (http://localhost:8080/files/123.pdf) in the browser address bar, without logging into the portal, I could access the file.

Basically I want to secure the 'files' folder under 'webapps', so that only authenticated users in portal could access resources under 'files' folder. How can I achieve this?

Upvotes: 2

Views: 7649

Answers (2)

mitrpathak
mitrpathak

Reputation: 101

Just add another configuration in your spring web config:

@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
    registry
            .addResourceHandler("reports/**")
            .addResourceLocations(reportsRootPath);
}

reportsRootPath is defined in properties file which could be any file System location.

Files are accessible like; reports/myReport.pdf

Here is the documentation which guided me

Upvotes: 0

SyAu
SyAu

Reputation: 1681

I found a way to solve this problem. This is what I came up with,

1) Convert 'files' folder to a web application and make files (say pdf) secured by using tomcat's FORM based authentication

2) After getting authenticated to 'myweb' - here authentication is not tomcat container based, its based on spring & hibernate -

asynchronously invoke a servlet (PopulateServlet.java) in 'files' web app from '/myweb/customerhomepage.jsp' and set tomcat role username & pwd in 'files' web app session

whenever there is a request to protected pdf under 'files' web app, login.jsp will be invoked - in this jsp populate hidden j_username & j_password fields from session object which was already populated by PopulateServlet. Using jquery ajax, the html form will be submitted to tomcat for resource authentication.

'files' web app changes:

Create new role and user name and password
/conf/tomcat-users.xml

    <role rolename="tomcat"/>
    <user username="tomcat" password="tomcat" roles="tomcat"/>

Create WEB-INF/web.xml

    <servlet>
    <servlet-name>Populate</servlet-name>
    <servlet-class>PopulateServlet</servlet-class>
    </servlet>
    <servlet-mapping>
    <servlet-name>Populate</servlet-name>
    <url-pattern>/Populate</url-pattern>
    </servlet-mapping>

    <servlet>
    <servlet-name>Logout</servlet-name>
    <servlet-class>LogOutServlet</servlet-class> <!-- in this servlet, call session.invalidate() -->
    </servlet>
    <servlet-mapping>
    <servlet-name>Logout</servlet-name>
    <url-pattern>/Logout</url-pattern>
    </servlet-mapping>

<security-constraint>
  <display-name>Security Constraint</display-name>
  <web-resource-collection>
     <web-resource-name>Protected Area</web-resource-name>
     <url-pattern>/jsp/security/protected/*</url-pattern>
     <url-pattern>*.pdf</url-pattern>

     <http-method>DELETE</http-method>
     <http-method>GET</http-method>
     <http-method>POST</http-method>
     <http-method>PUT</http-method>
  </web-resource-collection>
  <auth-constraint>
     <role-name>tomcat</role-name>
  </auth-constraint>
</security-constraint>

<login-config>
  <auth-method>FORM</auth-method>
  <realm-name>Form-Based Authentication Area</realm-name>
  <form-login-config>
    <form-login-page>/jsp/security/protected/login.jsp</form-login-page>
    <form-error-page>/jsp/security/protected/error.jsp</form-error-page>
  </form-login-config>
</login-config>

<!-- Security roles referenced by this web application -->
<security-role>
  <role-name>tomcat</role-name>
</security-role>

Create login.jsp and error.jsp under /files/jsp/security/protected/

login.jsp

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js"></script>
<script type="text/javascript">
$(document).ready(function() {
    $("#secure").submit();
});
</script>
...
<form method="POST" action='<%= response.encodeURL("j_security_check") %>' name="secure" id="secure">
<input type="hidden" name="j_username" value='<%=session.getAttribute("j_username")%>' />
<input type="hidden" name="j_password" value='<%=session.getAttribute("j_password")%>' />
</form>
...

PopulateServlet.java

HttpSession session = request.getSession(true);
session.setAttribute("j_username","tomcat");
session.setAttribute("j_password","tomcat");

'myweb' web app changes: customerhomepage.jsp

$.get('/files/Populate?ts='+new Date().getMilliseconds());

Upvotes: 5

Related Questions