CODEWITHSUNDEEP
javajspservlets
Digicom
Digicom

Reputation: 154

How to disable direct access to jsp pages?

I have a jsp page in java project, and i use from below code for hidden jsp extension from url, but also load my page with jsp extension in url. how to prevent of this? my code:

<servlet> 
<servlet-name>myTest</servlet-name>
<jsp-file>/testing.jsp</jsp-file>
</servlet>
<servlet-mapping>
<servlet-name>myTest</servlet-name>
<url-pattern>/test</url-pattern>
</servlet-mapping>

and url testing is : localhost/testing.jsp and my testing page is access.

Upvotes: 8

Views: 17200

Answers (4)

Alan Hay
Alan Hay

Reputation: 23246

You can prevent direct access to jsp files by adding the following to your web.xml, altering the url pattern as required.

<security-constraint>
        <web-resource-collection>
            <web-resource-name>JSP Files</web-resource-name>
            <description>No direct access to JSP files</description>
            <url-pattern>/pages/*</url-pattern>
            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
            <description>No direct browser access to JSP files</description>
            <role-name>NobodyHasThisRole</role-name>
        </auth-constraint>
    </security-constraint>

Upvotes: -1

Sas
Sas

Reputation: 2503

You could also use a filter and deny access to jsps.

<filter>
   <filter-name>JspFilter</filter-name>
   <filter-class>my.JspFilter</filter-class>
</filter>
<filter-mapping>
  <filter-name>JspFilter</filter-name>
  <url-pattern>*.jsp</url-pattern>
</filter-mapping>

Fitler:

public class JspFilter implements Filter{
  public void  doFilter(ServletRequest request, ServletReponse response,                
           FilterChain chain) {
    HttpServletRequest req= (HttpServletRequest) request;
    req.getRequestDispather("error.jsp).forward(request,response);
  }
}

Upvotes: 3

Gas
Gas

Reputation: 18050

For a quick solution, just put your JSP pages to the WEB-INF folder (then they will not be directly accessible) and define them like this:

   <servlet>
        <description>
        </description>
        <display-name>hidden</display-name>
        <servlet-name>hidden</servlet-name>
        <jsp-file>/WEB-INF/hidden.jsp</jsp-file>
    </servlet>
    <servlet-mapping>
        <servlet-name>hidden</servlet-name>
        <url-pattern>/hidden</url-pattern>
    </servlet-mapping>

but you should consider using frameworks to do it, like Struts2 or Spring.

Upvotes: 5

craigwor
craigwor

Reputation: 661

I would map the url to the servlet and then return the jsp from the servlet. eg:

In web xml:

<servlet>
    <servlet-name>testServlet</servlet-name>
    <servlet-class>com.yourpackage.testServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>testServlet</servlet-name>
    <url-pattern>/test</url-pattern>
</servlet-mapping>

In servlet:

request.getRequestDispatcher("testing.jsp").forward(request, response);

So your url pattern will be /test but the testing.jsp page will be loaded. Hope this helps.

Upvotes: 0

Related Questions