Return-Path: <ukalumni@bigfoot.com>
Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Delivered-To: mailing list tomcat-user@jakarta.apache.org
Received: (qmail 76779 invoked from network); 1 Feb 2001 06:14:07 -0000
Received: from c007-h000.c007.snv.cp.net (HELO c007.snv.cp.net)
 (209.228.33.206)
  by h31.sny.collab.net with SMTP; 1 Feb 2001 06:14:07 -0000
Received: (cpmta 2005 invoked from network); 31 Jan 2001 22:13:49 -0800
Received: from dsl-64-192-117-117.telocity.com (HELO bmolloy) (64.192.117.117)
  by smtp.telocity.com (209.228.33.206) with SMTP; 31 Jan 2001 22:13:49 -0800
X-Sent: 1 Feb 2001 06:13:49 GMT
From: "Michael Molloy" <ukalumni@bigfoot.com>
To: <tomcat-user@jakarta.apache.org>
Subject: RE: How to prevent a .jsp from being accessed directly?
Date: Thu, 1 Feb 2001 00:13:46 -0600
Message-ID: <NEBBKJONALOHJIJNLBLOEEJFCAAA.ukalumni@bigfoot.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
In-Reply-To: <NEBBKJONALOHJIJNLBLOKEJECAAA.ukalumni@bigfoot.com>
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200
Importance: Normal
X-Spam-Rating: h31.sny.collab.net 1.6.2 0/1000/N

Sorry for sending that to the list. Supposed to have been backchannel.

--Michael

-----Original Message-----
From: Michael Molloy [mailto:ukalumni@bigfoot.com]
Sent: Wednesday, January 31, 2001 11:38 PM
To: tomcat-user@jakarta.apache.org
Subject: RE: How to prevent a .jsp from being accessed directly?


Bob, I thought I had tried all combinations, but I apparently I had tried
them all except the right one. Thanks for your help.

--Michael

-----Original Message-----
From: BBueckers@sjm.com [mailto:BBueckers@sjm.com]
Sent: Tuesday, January 30, 2001 4:50 PM
To: tomcat-user@jakarta.apache.org
Subject: RE: How to prevent a .jsp from being accessed directly?


Don't include the www.... in your url-pattern rather if you directory
structure is

Tomcat
|
 -- webapps
   |
    -- mywebapp
      |
	 -- jsps
	     	selectroster.jsp
		another.jsp
		another2.jsp

you would include <url-pattern>/jsps/selectroster.jsp</url-pattern>

What version of tomcat are you using? What is your environment?

Bob

-----Original Message-----
From: Michael Molloy [mailto:ukalumni@bigfoot.com]
Sent: Tuesday, January 30, 2001 4:44 PM
To: tomcat-user@jakarta.apache.org
Subject: RE: How to prevent a .jsp from being accessed directly?


I've tried several variations, from your suggestion below to including the
entire url (www. . . .).

I'll take another look at it.

Thanks
--Michael

-----Original Message-----
From: BBueckers@sjm.com [mailto:BBueckers@sjm.com]
Sent: Tuesday, January 30, 2001 4:29 PM
To: tomcat-user@jakarta.apache.org
Subject: RE: How to prevent a .jsp from being accessed directly?


You may want to try setting the url pattern relative to the root i.e.
	<url-pattern>/dir1/subdir1/selectroster.jsp</url-pattern>

Bob

-----Original Message-----
From: Michael Molloy [mailto:ukalumni@bigfoot.com]
Sent: Monday, January 29, 2001 7:41 PM
To: Tomcat
Subject: How to prevent a .jsp from being accessed directly?


I'm using the following web.xml file inside a servlet context
(/opt/tomcat/webapps/staging/WEB-INF/web.xml). However, it's not preventing
direct access to the jsp file, which is what I'm hoping to achieve. I got
this from the O'Reilly Javaserver Pages book, but it's not working. Any
suggestions?

Thanks
--Michael

<web-app>
        <servlet>
                <servlet-name>RosterServlet</servlet-name>
                <servlet-class>RosterServlet</servlet-class>
                <load-on-startup>1</load-on-startup>

        </servlet>
        <servlet-mapping>
                <servlet-name>RosterServlet</servlet-name>
                <url-pattern>/process</url-pattern>
        </servlet-mapping>
        <security-constraint>
                <web-resource-collection>
                        <web-resource-name>no-access</web-resource-name>
                        <url-pattern>selectroster.jsp</url-pattern>
                </web-resource-collection>
                <auth-constraint>
                        <role-name>nobody</role-name>
                </auth-constraint>
        </security-constraint>
</web-app>


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, email: tomcat-user-help@jakarta.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, email: tomcat-user-help@jakarta.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, email: tomcat-user-help@jakarta.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, email: tomcat-user-help@jakarta.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, email: tomcat-user-help@jakarta.apache.org