Okay, so we're upgrading to Tomcat 6, and we've encountered a difficulty.
In order to keep URLs consistent (for simpler log parsing and for
cosmetic reasons) the idea is to have a servlet as the controller and a
JSP for the display, but only ever to have the servlet URL visible to the
user. As such:
servlet: /path/servlet
jsp: /path/page.jsp
The main access is through the servlet, and at the appropriate moment the
user is forwarded to the JSP, using:
RequestDispatcher dispatcher =
request.getRequestDispatcher("/path/page.jsp");
dispatcher.forward(request, response);
Using Tomcat 5.0, I was able, in the JSP, to use (nothing really hard
coded):
if (request.getRequestURL().toString().indexOf("page.jsp") != -1) {
response.sendRedirect("/path/servlet");
return;
}
.... because the request URL was that of the servlet from which the
forward was called. In Tomcat 6, however, the request URL is that of the
forward target.
Reading the API, it looks as if this should have been the behaviour all
along, but that's moot. The question is: How can I prevent direct access
to the JSP in another way?
Cheers,
-- Robert
|
|
0
|
|
|
|
Reply
|
Robert
|
6/20/2007 3:11:57 PM |
|
Robert Watkins wrote:> > Reading the API, it looks as if this should have been the behaviour all > along, but that's moot. The question is: How can I prevent direct access > to the JSP in another way?Put the JSP under /WEB-INF/.Tom Hawtin
|
|
0
|
|
|
|
Reply
|
Tom
|
6/20/2007 3:36:18 PM
|
|
Tom Hawtin <usenet@tackline.plus.com> wrote innews:46794827$0$8754$ed2619ec@ptn-nntp-reader02.plus.net: > Robert Watkins wrote:>> >> Reading the API, it looks as if this should have been the behaviour>> all along, but that's moot. The question is: How can I prevent direct>> access to the JSP in another way?> > Put the JSP under /WEB-INF/.> > Tom Hawtin> Hmmm -- must be something I'm missing, because I get a 404 error: The requested resource (/path/page.jsp) is not available.Does the forward path have to change?-- Robert
|
|
0
|
|
|
|
Reply
|
Robert
|
6/20/2007 3:46:25 PM
|
|
Tom Hawtin <usenet@tackline.plus.com> wrote in
>> Put the JSP under /WEB-INF/.
>>
>> Tom Hawtin
Robert Watkins wrote:
> Hmmm -- must be something I'm missing, because I get a 404 error:
>
> The requested resource (/path/page.jsp) is not available.
It is for the correct value of 'path'.
> Does the forward path have to change?
It has to include the WEB-INF/ path node.
Either:
RequestDispatcher dispatcher =
request.getRequestDispatcher( "/application/WEB-INF/page.jsp" );
or just
RequestDispatcher dispatcher =
request.getRequestDispatcher( "WEB-INF/page.jsp" );
I usually use relative paths (always down from current, never up).
BTW, if you had provided an SSCCE instead of paraphrasing as 'path',
'page.jsp', etc., you'd have had a much clearer question. Notice how
hand-waving over 'path' actually obscured the issue?
--
Lew
|
|
0
|
|
|
|
Reply
|
lew3286 (13)
|
6/20/2007 5:17:01 PM
|
|
Robert Watkins wrote:
> Tom Hawtin <usenet@tackline.plus.com> wrote in
> news:46794827$0$8754$ed2619ec@ptn-nntp-reader02.plus.net:
>
>> Robert Watkins wrote:
>>> Reading the API, it looks as if this should have been the behaviour
>>> all along, but that's moot. The question is: How can I prevent direct
>>> access to the JSP in another way?
>> Put the JSP under /WEB-INF/.
>>
>> Tom Hawtin
>>
>
> Hmmm -- must be something I'm missing, because I get a 404 error:
>
> The requested resource (/path/page.jsp) is not available.
>
> Does the forward path have to change?
>
> -- Robert
Tom Hawtin <usenet@tackline.plus.com> wrote in
>> Put the JSP under /WEB-INF/.
>>
>> Tom Hawtin
Robert Watkins wrote:
> Hmmm -- must be something I'm missing, because I get a 404 error:
>
> The requested resource (/path/page.jsp) is not available.
It is for the correct value of 'path'.
> Does the forward path have to change?
It has to include the WEB-INF/ path node.
Either:
RequestDispatcher dispatcher =
request.getRequestDispatcher( "/application/WEB-INF/page.jsp" );
or just
RequestDispatcher dispatcher =
request.getRequestDispatcher( "WEB-INF/page.jsp" );
I usually use relative paths (always down from current, never up).
BTW, if you had provided an SSCCE instead of paraphrasing as 'path',
'page.jsp', etc., you'd have had a much clearer question. Notice how
hand-waving over 'path' actually obscured the issue?
--
Lew
|
|
0
|
|
|
|
Reply
|
lew3286 (13)
|
6/20/2007 6:24:16 PM
|
|
Robert Watkins wrote:>>> Reading the API, it looks as if this should have been the behaviour>>> all along, but that's moot. The question is: How can I prevent direct>>> access to the JSP in another way?Tom Hawtin <usenet@tackline.plus.com> wrote in>> Put the JSP under /WEB-INF/.Robert Watkins wrote:> Hmmm -- must be something I'm missing, because I get a 404 error:> > The requested resource (/path/page.jsp) is not available.It is for the correct value of 'path'.> Does the forward path have to change?It has to include the WEB-INF/ path node.Either: RequestDispatcher dispatcher = request.getRequestDispatcher( "/application/WEB-INF/page.jsp" );or just RequestDispatcher dispatcher = request.getRequestDispatcher( "WEB-INF/page.jsp" );I usually use relative paths (always down from current, never up).BTW, if you had provided an SSCCE instead of paraphrasing as 'path', 'page.jsp', etc., you'd have had a much clearer question. Notice how hand-waving over 'path' actually obscured the issue?-- Lew
|
|
0
|
|
|
|
Reply
|
Lew
|
6/20/2007 6:37:04 PM
|
|
Lew <lew@lewscanon.nospam> wrote in news:h5WdnfgGt6mT_OTbnZ2dnUVZ_oavnZ2d@comcast.com:> Tom Hawtin <usenet@tackline.plus.com> wrote in>>> Put the JSP under /WEB-INF/.>>>>>> Tom Hawtin> > Robert Watkins wrote:>> Does the forward path have to change?> > It has to include the WEB-INF/ path node.> Thanks for this final piece of the puzzle. All is working now, with the desired effect.-- Robert
|
|
0
|
|
|
|
Reply
|
Robert
|
6/20/2007 8:02:26 PM
|
|
|
6 Replies
285 Views
(page loaded in 0.117 seconds)
Similiar Articles: prevent direct access to JSP - comp.lang.java.programmer ...Okay, so we're upgrading to Tomcat 6, and we've encountered a difficulty. In order to keep URLs consistent (for simpler log parsing and for cosmetic... Passing checkbox values from one JSP page to another - comp.lang ...prevent direct access to JSP - comp.lang.java.programmer ..... servlet: /path/servlet jsp: /path/page.jsp The ... is: How can I prevent direct access to the JSP in ... ntvdm encountered a hard error - comp.lang.asm.x86prevent direct access to JSP - comp.lang.java.programmer ... Okay, so we're upgrading to Tomcat 6, and we've encountered a ... I was able, in the JSP, to use (nothing ... Jobs for Parallel Programmers ? - comp.parallel.mpiprevent direct access to JSP - comp.lang.java.programmer ... comp.lang.java.programmer 51607 articles. 18 followers. ... second is a par= allel-to-serial and serial-to ... Voltage Limiting Input Voltage to Codec ADC - comp.dspprevent direct access to JSP - comp.lang.java.programmer ... Voltage Limiting Input Voltage to Codec ADC - comp.dsp Surely, they're not simple diodes to prevent the rails ... Input on RAID 1 - comp.cad.solidworksprevent direct access to JSP - comp.lang.java.programmer ... This is one of the tricky parts of > software RAID: it still allows direct access to ... ... Display PDF from Ajax Response - comp.lang.javascriptThis technique might be used to prevent direct linking to the pdf files by external websites, as attempts to access the file without a session id or from an external ... comp.emacs - page 2... jdee.sunsite.dk/) using RemoteEclipse plugin (http://www.raffael.ch/index.jsp)? ... Thanks Andre -- Direct access to this group with http://web2news.com http://web2news ... access to workspace variable - comp.soft-sys.matlabThere is no problem if it will be in .mat file. I need direct access ... GUDIE .m file - comp.soft ..... callback function and stop_button_callback > function can access ... Locking out users by name for direct login. Allow SU - only - comp ...Does anyone know a method to lockout non root users from direct access (telnet, ssh ... just lock the account - passwd -l <user> Locking the account shouldn't stop ... Struts - User - How to prevent direct access to JSPHow to prevent direct access to JSP. Hi Guys, Can anyone suggest me how to prevent an user entering a direct URL for the JSP instead of action, ie : *search.jsp ... How can you prevent users from accessing a JSP directly that is ...How can you prevent users from accessing a JSP directly that is designed to be used from an ... as Tomcat 4.0), this is interpreted to mean that there is no direct access ... 7/23/2012 7:33:36 PM
|