how to prevent *.xhtml pages from downloading?

[phantom]

Please, help me!

A have seam pages in *.xhtml files. Correct addresing to this page throught *.seam. But if I point IE to corresponding *.xhtml page - I can downlod it and view code. It seems quite unsecured.
Is there possibility to automaticly redirect from *.xhtml page to *.seam page?

Thank you!

[phantom]

To prevent this you can use following structure in web.xml:

 <security-constraint>
 <display-name>Restrict XHTML Documents</display-name>
 <web-resource-collection>
 <web-resource-name>XHTML</web-resource-name>
 <url-pattern>*.xhtml</url-pattern>
 </web-resource-collection>
 <auth-constraint>
 <role-name>NONE</role-name>
 </auth-constraint>
 </security-constraint>

But Is there any mechanism to automaticly redirect to corresponding seam page?

[shane.bryzak]

You can use the URL rewrite filter to rewrite .xhtml requests as .seam requests. The latest CVS version of Seam has this built in, look at the wiki example or seamBay example to see how it's used.

[hstang]

Just wondering if urlrewrite is GPLed or LGPLed?

Reading along http://jira.jboss.org/jira/browse/JBSEAM-274, have you heard anything regarding to request for change of license?

[hstang]

I downloaded the 3.0.4 and the accompanied license has changed to BSD.

Thanks.

[supernovasoftware.com]

I use the following and it has had no ill effect I can see. I have been using it in production for over a year.

This keeps the pages from being viewed with out being processed.

<filter-mapping>
 <filter-name>Seam Redirect Filter</filter-name>
 <url-pattern>*.xhtml</url-pattern>
 </filter-mapping>

[stephen.friedrich]

Maybe it saves somebody from a little trial and error.
If you just want to serve your pages (rather than source code) with *.xhtml URLs these rules do the job fine:

<rule match-type="wildcard">
 <from>/**.xhtml**</from>
 <to>/$1.seam$2</to>
 </rule>

 <outbound-rule match-type="wildcard">
 <from>/**.seam**</from>
 <to>/$1.xhtml$2</to>
 </outbound-rule>

Also be sure to add the rewrite filter as the _first_ filter in web.xml

[stephen.friedrich]

Sh*t - the rewrite rules I gave in my last post caused a problem:
If you have configured redirect-after-post in your faces-config.xml, then page parameters are lost during redirection.

Page parameters work fine if I either disabley tuckey or comment the < redirect /> tags in my faces-config.xml

No idea why or if it can be solved.

As a workaround here's what I now use instead:

<urlrewrite use-query-string="true">
 <!-- Prevent to ever serve raw xhtml by transparently mapping *.xhtml to *.seam and back -->
 <rule match-type="wildcard">
 <from>/**.xhtml**</from>
 <to type="redirect">%{context-path}/$1.seam$2</to>
 </rule>
</urlrewrite>