2 Replies Latest reply on Sep 5, 2004 10:07 PM by sebashkw

    How to prevent viewing of JSP

    sebashkw Newbie

      Hi

      I am using JBoss 3.2.3 with Struts. At the moment, the same page can be accessed using .jsp or .do extensions. How do I prevent access to jsp directly and force them to use do extension?

      I read that this is possible by configuring security in web.xml but not all AS supports it. Anyone have experience doing this in JBoss especially v3.2.3?

      Thanks

      Sebastian Ho

        • 1. Re: How to prevent viewing of JSP
          Ryan Ho Newbie

          What we have been doing is to put the JSP pages that are not meant for direct viewing inside WEB-INF.

          For example, you can create a folder under WEB-INF called "pages" and put all your jsp files there. You can then direct the request to use these pages in struts-config.xml

          • 2. Re: How to prevent viewing of JSP
            sebashkw Newbie

            Thanks Ryan. Surprised to find a fellow citizen replying to my emaill (hey singapore is not big on open source!).

            I heard about this solution but juz worried that it is not portable across different AS cos we might not be usign jboss after development stage.