How to prevent viewing of JSP

sebashkw Sep 2, 2004 11:18 PM

Hi

I am using JBoss 3.2.3 with Struts. At the moment, the same page can be accessed using .jsp or .do extensions. How do I prevent access to jsp directly and force them to use do extension?

I read that this is possible by configuring security in web.xml but not all AS supports it. Anyone have experience doing this in JBoss especially v3.2.3?

Thanks

Sebastian Ho

1. Re: How to prevent viewing of JSP

ryanho Sep 5, 2004 12:36 PM (in response to sebashkw)

What we have been doing is to put the JSP pages that are not meant for direct viewing inside WEB-INF.

For example, you can create a folder under WEB-INF called "pages" and put all your jsp files there. You can then direct the request to use these pages in struts-config.xml
Actions
2. Re: How to prevent viewing of JSP

sebashkw Sep 5, 2004 10:07 PM (in response to sebashkw)

Thanks Ryan. Surprised to find a fellow citizen replying to my emaill (hey singapore is not big on open source!).

I heard about this solution but juz worried that it is not portable across different AS cos we might not be usign jboss after development stage.
Actions

Go to original post