----- Original Message ----- From: "David Erickson" <[EMAIL PROTECTED]> To: "Struts Mailing List" <[EMAIL PROTECTED]> Sent: Wednesday, July 02, 2003 12:26 PM Subject: Webapp Security?
> Just curious how others have gone about protecting the resouces within their > webapp.. in our personal setup we would like to control access to every > resource if possible, we have our own custom login page that sets session > variables, and pulls the data from the database. > > We can authenticate people with code in each of the actions, but nothing is > preventing someone from directly going to a jpg or a jsp file or anything of > the like. What I thought about doing was subclassing the tomcat connectors, > the default, the jsp one, and the struts one and then authenticating each > request.. but that adds a lot of overhead. Anybody have any other good > ideas? We'd like to stick with just tomcat 4.1.24... no apache (no > .htaccess).. what is everyone else implementing? Preventing someone from directly going to the JSP pages for your web applications is right thing to do. I just posted a summary with the subject MVC, Security, and Redirect: 1) No one has direct access to any JSP pages in the web applications. 2) Anybody is able to invoke the generalized action controllers where the security checking is performed. You could use a dummy role nobody to protect all of your application oriented resources with the security constraints. If your user accounts are stored in database, like our implementation, you could map your users' id, group, ref, whatever to the role names specified on the action mappings. Giving uers dynamic privileges is also implemented in our codes. > -David > > Jing Netspread Carrier http://www.netspread.com > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]