How to Protect Your JSP page

To better protect your JSP against unauthorized access and peeping, a good way is to store the page file under the WEB-INF directory of the Web application.

Generally, JSP developers store their page files in the corresponding subdirectories of the Web application. A typical Store applicationProgramDirectory structure 2. JSP related to catalog is saved in the catalog subdirectory. JSP related to customer and JSP related to order are stored in this way.

The problem with this method is that these page files are easy to peek.Source codeOr directly called. In some cases, this may not be a big problem, but it may constitute a security risk in specific circumstances. It is also a problem that users can bypass struts controller to directly call JSP.

To reduce risk, you can move these page files to the WEB-INF directory. Servlet-based declarations do not make WEB-INF part of the Common Document Tree for Web applications. Therefore, the resources under the WEB-INF directory are not serving the customer directly. We can still use the JSP page under the WEB-INF directory to provide the view to the customer, but the customer cannot directly request access to JSP.

Using the previous example, Figure 3 shows the directory structure after moving the JSP page to the WEB-INF directory

If you move these JSP page files to the WEB-INF directory, you must add "WEB-INF" to the URL when calling the page. For example, write an action mapping for a logoff action in a struts configuration file. The JSP path must start with "WEB-INF. Note the bold Section as follows.

This method is a good method in struts practice under any circumstances. The only trick to note is that you must associate JSP with a struts action. Even if this action is just a very basic JSP, it always calls an action and then calls JSP.

It should be noted that not all containers support this feature. WebLogic earlier versions do not support servlet declarations, so it is reported that they have been improved in the new version. Check your servlet container before using it.