Restricting access to a WEB-INF subfolder 2005-01-26 - By Ben Hill
Back
On Wed, 2005-01-26 at 01:17, Jean-Christian Imbeault wrote:
> #1- If I put the files under the web directory, a user could write a URL
> to the file and see it. Is there any way for me to restrict access to this
> directory so that only my servlet can see the files. I.e. a user needs to
> request a file through my servlet.
>
> #2- If I put the files under WEB-INF, the files are hidden from users and
> they cannot create a URL to see them. However from what I have read it
> will also not be possible to forward a request to those files. Is there
> any way for me to have my servlet forward requests to file under WEB-INF
> while at the same time make it impossible for users to create a URL to
> those files?
The spec states that you shouldn't be able to view files via the web
server. Some web servers will allow you to include resources from the
WEB-INF directory in a request, and some wont.
It's generally a bad plan to have this kind of content under your
WEB-INF directory though, and much better to have them outside of the
web root.
--
ben@(protected)
www.javacoder.net - "Java coding, from the source!"
===========================================================================
To unsubscribe, send email to listserv@(protected) and include in the body
of the message "signoff J2EE-INTEREST". For general help, send email to
listserv@(protected) and include in the body of the message "help".
|
|
