How to forbid any user to directly ping xhtml file?

[titou09]

If a user enters an adress like http://<serveur>/App/any-valid-page-name.xhtml in  its browser, by default the xhtml source file will be displayed which is obvisouly not what we want.

I'm thinking of three ways to solve this and to send back a nice 404-page not found to the user

• write a filter mapped to *.xhtml before the seam filter and redirect to the page not found page if called


• declare a seam  filter thanks to the @Filter annotation (But will this interfere with seam?)


• use some kind of declaration in page.xml?

How are you guys dealing with this problem?

Thx

[niox.nikospara.yahoo.com]

They have solved it in Seam-gen :)

In web.xml:

     <security-constraint>
          <display-name>Restrict raw XHTML Documents</display-name>
          <web-resource-collection>
               <web-resource-name>XHTML</web-resource-name>
               <url-pattern>*.xhtml</url-pattern>
          </web-resource-collection>
          <auth-constraint/>
     </security-constraint>

[titou09]

This does not work because

• the user need to be loggued for this to work. There must be a security context to trigger the security-constraint rules  (At least in websphere). Not all of our pages requires to be loggued.


• with this, when the user is loggued and try to ping directly an xhtml page, he will receive a 403-not authorized response instead of a 404-not-found page as it should.

[luxspes]

AFAIK this is already handled in  the web.xml generated by default by seam-gen:

<security-constraint>
  <display-name>Restrict raw XHTML Documents</display-name>
  <web-resource-collection>
   <web-resource-name>XHTML</web-resource-name>
   <url-pattern>*.xhtml</url-pattern>
  </web-resource-collection>
  <auth-constraint/>
 </security-constraint>

[niox.nikospara.yahoo.com]

Websphere :(

The <security-constraint> works on JBoss.

Anyway, why don't you try a simple servlet, mapped to *.xhtml that always responds with response.sendError(HttpServletResponse.SC_NOT_FOUND).

[luxspes]

It works in tomcat for me... and this is not JBoss specific, it works in Tomcat, and in Glassfish, and in WebLogic...

[titou09]

I've declared a filter assigned to the *.xhtml uri, before the seam filter. This filter just redirect the user to the 404 page not found error page

I'm curious to know how tomcat is redirecting the user to the 404 page not found error page and not to the 403 not authorized page in this case...
Is there a tomcat configuration elsewhere to specify where to redirect the user in this case?