Access jsp pages in WEB-INF directory

Hi,
I've a problem with my jsp web project;
practically I've created a web project that uses jsp pages and servlet.
I never use links to jsp pages, directly in my web pages, but I call always first servlet;
the servlet call jsp pages.
My project is completed and works fine, but any user can access to my jsp pages directly simply writing the url.
So I've tried to move my jsp pages in the WEB-INF directory, but now I doesn't manage in accessing index.jsp page;
how must I do to access index.jsp page?
I've tried to modify web.xml like this
<welcome-file-list>
          <welcome-file>WEB-INF/index.jsp</welcome-file>
     </welcome-file-list>
but doesn't work;
besides also servlet calls to jsp pages doesn't work anymore.
How can I solve?
Thank you in advance
MargNat

ok, so first you have to implement the Filter interface, with 3 methods,
the main method u have to put logic in is doFilter()
public class YourClass implements javax.servlet.Filter {
doFilter(ServletRequest req, ServletResponse res, FIlterChain chain) throws ... {
//check first if is HTTP, if in this case permission is not granted as well
if(req instanceof HttpServletRequest{
HttpServletRequest httpReq = (HttpServletRequest)req;
//now check if its called for index.jsp
if(!httpReq.getRequestURI().toLowerCase().endsWith("index.jsp"))
   throw new ServletException("access permitted");
else
  chain.doFilter(req,res); //go on with processing
}else
throw new ServletException("only HTTP requests allowed");
}and of course you have to register that filter in your web.xml doing
  <filter>
    <filter-name>yourFilter</filter-name>
<filter-class>yourFilterClass</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>yourFilter</filter-name>
    <url-pattern>/**.jsp</url-pattern>
  </filter-mapping>actually that's it

Similar Messages

  • Access JSF Pages within WEB-INF directory

    Hi,
    I am generating a project using JHeadstart 10.1.3
    with the default setting for the UI Pages directory (/WEB-INF/page).
    This means that the generated pages are placed in the page directory
    within the WEB-INF directory.
    The generated pages use ADF Faces and the problem is that I can't
    get access to the pages in the WEB-INF directory
    When I try to deploy to OC4J standalone, the pages in the WEB-INF directory
    are not accessible.
    I read that I have to construct a index.jspx file that forwards to
    the first page (Home.jspx)
    This is my index.jspx:
    <jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.0">
    <jsp:scriptlet> request.getRequestDispatcher("WEB-INF/page/Home.jspx").forward(request,response);
    </jsp:scriptlet>
    </jsp:root>
    This works, but I now have the problem of not getting a valid FacesContext:
    500 Internal Server Error
    javax.servlet.jsp.JspException: Cannot find FacesContext
    at javax.faces.webapp.UIComponentTag.doStartTag(UIComponentTag.java:405)
    at com.sun.faces.taglib.jsf_core.ViewTag.doStartTag(ViewTag.java:105)
    at web2d_inf._page._Home_jspx._jspService(_Home_jspx.java:100)
    [SRC:/WEB-INF/page/Home.jspx:9]
    at com.orionserver[Oracle Containers for J2EE 10g (10.1.3.0.0) ].http.OrionHttpJspPage.service(OrionHttpJspPage.java:59)
    at oracle.jsp.runtimev2.JspPageTable.compileAndServe(JspPageTable.java:662)
    at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:370)
    at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:478)
    etc. etc.
    What is the required way of setting up the forward (and having a valid FacesContext)?
    I know that this is a JHeadstart problem, but maybe you guys know how to solve it.
    Part of my web.xml:
    <description>Empty web.xml file for Web Application</description>
    <context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>client</param-value>
    </context-param>
    <context-param>
    <param-name>javax.faces.CONFIG_FILES</param-name>
    <param-value>/WEB-INF/faces-config.xml,/WEB-INF/custom-faces-config.xml,/WEB-INF/JhsCommon-beans.xml,/WEB-INF/AppModule-Breadcrumb-beans.xml,/WEB-INF/Bpas-beans.xml,/WEB-INF/BpasLookup-beans.xml,/WEB-INF/GroupsLookup-beans.xml,/WEB-INF/PersonsLookup-beans.xml,/WEB-INF/OrganizationsLookup-beans.xml</param-value>
    </context-param>
    <context-param>
    <param-name>CpxFileName</param-name>
    <param-value>sumawest.view.DataBindings</param-value>
    </context-param>
    <filter>
    <filter-name>adfFaces</filter-name>
    <filter-class>oracle.adf.view.faces.webapp.AdfFacesFilter</filter-class>
    </filter>
    <filter>
    <filter-name>adfBindings</filter-name>
    <filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
    </filter>
    <filter-mapping>
    <filter-name>adfFaces</filter-name>
    <url-pattern>*.jsp</url-pattern>
    </filter-mapping>
    <filter-mapping>
    <filter-name>adfFaces</filter-name>
    <url-pattern>*.jspx</url-pattern>
    </filter-mapping>
    <filter-mapping>
    <filter-name>adfFaces</filter-name>
    <servlet-name>Faces Servlet</servlet-name>
    </filter-mapping>
    <filter-mapping>
    <filter-name>adfBindings</filter-name>
    <url-pattern>*.jsp</url-pattern>
    </filter-mapping>
    <filter-mapping>
    <filter-name>adfBindings</filter-name>
    <url-pattern>*.jspx</url-pattern>
    </filter-mapping>
    <filter-mapping>
    <filter-name>adfBindings</filter-name>
    <servlet-name>ordDeliverMedia</servlet-name>
    </filter-mapping>
    <servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet>
    <servlet-name>ordDeliverMedia</servlet-name>
    <servlet-class>oracle.ord.html.OrdPlayMediaServlet</servlet-class>
    <init-param>
    <param-name>releaseMode</param-name>
    <param-value>Stateful</param-value>
    </init-param>
    </servlet>
    <servlet>
    <servlet-name>resources</servlet-name>
    <servlet-class>oracle.adf.view.faces.webapp.ResourceServlet</servlet-class>
    </servlet>
    <servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
    <servlet-name>ordDeliverMedia</servlet-name>
    <url-pattern>ordDeliverMedia</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
    <servlet-name>resources</servlet-name>
    <url-pattern>/adf/*</url-pattern>
    </servlet-mapping>
    <session-config>
    <session-timeout>35</session-timeout>
    </session-config>
    <mime-mapping>
    <extension>html</extension>
    <mime-type>text/html</mime-type>
    </mime-mapping>
    <mime-mapping>
    <extension>txt</extension>
    <mime-type>text/plain</mime-type>
    </mime-mapping>
    <welcome-file-list>
    <welcome-file>index.jspx</welcome-file>
    </welcome-file-list>

    I do something similar in my index.jspx file - but I needed to add "faces" to the url path. This will have the faces servlet process it and setup the faces context.
    Have you tried changing
    request.getRequestDispatcher("WEB-INF/page/Home.jspx").forward(request,response);to
    request.getRequestDispatcher("faces/WEB-INF/page/Home.jspx").forward(request,response);

  • Access JSP pages under WEB-INF

    Hello, I have a web application and i use Java,JSP, servlets etc.
    In my webpage i have three different categories of users
    *1)* Registered users
    *2)* Not Registered users
    *3)* Administrator
    I would like the welcome page index.jsp and register page be accessed by everyone.
    But as far as the other pages are concerned , i would like to be accessed only by the registered users.
    What shall i do??
    I placed the index.jsp and register.jsp under the public folder and the other pages under WEB-INF folder in order to be accesses only from the registered users.
    But it's not working!
    What exactly shall i do in order to make that work??
    Thanks, in advance!

    g_p_java wrote:
    Thanks for the link! As i understood i don't have to place my web pages under WEB-INF (only the web.xml which is already there).
    *1)* So i have to follow the steps that are being mentioned there for all the users right??
    Registered , Not Registered and admin.
    Yes, security constraining through web.xml is a url pattern based protection for your resources. You could create multiple urls - /secured/* and map them to your resources accessible to registered users only or you may have /admin/* and define that only 'admin' roles have access to these resources. Some portions of such setup would be server specific (eg: how you create users and map them to roles)
    *2)* I would like to make a question: Who is the "FrontController" in the link you posted me? [http://onjava.com/onjava/2001/08/06/webform.html]
    It's the Container. Because such features are mandated by the spec, the container provides an implementation and options to customize the implementation (for example in weblogic, you can specify that your users are bound to an LDAP or configured in a Users table in the db)
    Nevertheless, you would have your own Controllers for your application management (Struts or Spring or whatever suits your need). On the same note, you should have your own Filters to implement whatever common logic you have across your application.
    Madathil_Prasad wrote:
    2. Write a filter that checks for the presence of a session (and entitlements possibly) before allowing access to a resource.
    *3)* when you write "_entitlements_" what exactly do you mean??
    Thanks!
    This is the other road I was talking about. You could throw all configuration and j2ee based security configuration out of the window (they do have their limitations) and implement custom security logic in a Filter. For example,
    String urlPattern = request.getRequestURI();
    if(urlPattern.indexOf("/secured") != null{
             if(request.getSession(false) == null){
                   //redirect to login page.
             }else{
                  //valid session
                  //now check specific entitlement to see whether user has access
    }Here entitlement refers to permissions at a granular level (authorization if you wish to call it). For example, you have 2 kinds of admin users - some who can generate reports of web activity and another who can change application settings.
    ram.

  • Forwarding to jsp page inside web-inf

    hi everyone,
    i have a question. i have jsp pages inside web-inf folder and i have welcome page of project(outside web-inf) in pages from where i want to give link to jsp page inside web-inf folder. this project is absed on spring framework. how can i do this?
    thanks in advance

    hi everyone,
    i have a question. i have jsp pages inside web-inf folder and i have welcome page of project(outside web-inf) in pages from where i want to give link to jsp page inside web-inf folder. this project is absed on spring framework. how can i do this?
    thanks in advance

  • Retrieve JSP page From WEB-INF

    I have query about,
    how to retrieve Jsp page that i have put in WEB-INF director,
    session.setAttributes("Here Vector not String","Value")..
    i want to set value with in vectore using above session attributes, i dont wanto set one attributes but more values in one vectore using session,

    Web pages under WEB-INF can not be accessed directly by the client.
    That is by design.
    However you can forward/include them with the RequestDispatcher, or using <jsp:forward>/<jsp:include>
    I don't understand what the bit setting session attributes is about.

  • ADF Faces - access to content in WEB-INF directory

    Hello,
    I create simple JSF application that use ADF Faces and deploy it to Oracle iAS. But why can i also access files in WEB-INF directory? For example, the following URL - http://myserver.si/MyApp/faces/WEB-INF/web.xml - will return the content of XML file. By my knowledge of J2EE architecture, access to this directory should be forbidden.
    Should I set some parameter on javax.faces.webapp.FacesServlet servlet filter to prevent access to WEB-INF directory? Thank you for help.
    Google also found the following links:
    - http://mail-archives.apache.org/mod_mbox/myfaces-dev/200602.mbox/%[email protected]%3E
    - http://svn.apache.org/viewcvs.cgi//myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java/?rev=375489&view=diff&r1=375489&r2=375488&p1=/myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java&p2=/myfaces/core/trunk/api/src/main/java/javax/faces/webapp/FacesServlet.java
    Regards,
    Matic

    Hi,
    the reason for this is that the WEB-INF directory is protected against direct client (browser) requests. Using Faces, the JSF servlet performs this access as a server side forward request in which case there is no container-managed protection.
    If you want to avoid this then you can write a servlet filter in fron of JSF in which you check for any occurences of directories you want to prohibit access to.
    Its not a bug, its the way J2EE is designed ;-(
    Frank

  • Warning - When Compiling .jsp pages under WEB-INF

    Created a directory jsp under WEB-INF and when i compile the jsp pages i get the following warning message
    Warning: package name web2d_inf._jsp does not match source file name C:\ProviderEnrollment\ProvEnrollView\classes\.jsps\_WEB_2d_INF\_jsp\_searchprovider.java
    Need help
    Thanks

    We have encountered this warning too.
    I'm not an Oracle employee, but it looks like there's a bug in JDev that preserves the case for the output directories but not for the package name that is supposed to correspond to the output directories.
    In any case, we haven't seen any runtime problems that seem to be related to this warning, so you may be safe to disregard it. It does foul up the build log though.
    Any JDev team members watching this topic are welcome to chime in with a confirmation and details of this apparent bug, as well as any workaround that might exist to avoid having the warning appear. Thanks!

  • How can I forward to a jsp under the WEB-INF directory?

    I have a webapp with a jsp that forwards to a jsp called /WEB-INF/pages/secure.jsp When I try to forward to it, I get the error:
    "trying to GET /mywebapp/WEB-INF/pages/secure.jsp, deny-existence reports: denying existence of /web/webapps/mywebapp/WEB-INF/pages/secure.jsp"
    How can I forward to this page?
    Thanks,
    Micah

    Craig - I'm trying to do something very similar - build a waiting page into the
    flow. I've got a support case open (to get the BEA recommended approach) but so
    far have had no luck. Let me know if you've found the answer - or are still struggling.
    Cheers,
    Niall
    [email protected] (Craig Coffin) wrote:
    I am trying to get a JSP in a portlet to forward to a Webflow URL,
    without much success...
    The following code produces the ubiquitous "Functionality temporarily
    unavailable" message, presumably because jsp:forward chokes on the
    absolute URL:
    <c:set var="url">
    <portlet:createWebflowURL event="next"/>
    </c:set>
    <%
    // convert to a scripting variable for the jsp:forward tag
    String url = (String) pageContext.getAttribute("url");
    %>
    <jsp:forward page="<%=url%>"/>
    Using c:redirect fares little better. This code produces an empty
    portlet:
    <c:set var="url">
    <portlet:createWebflowURL event="next"/>
    </c:set>
    <c:redirect url="${url}"/>
    The closest I've been able to get is to have the user click a link to
    get to the next page, but I'd like to have an automatic forward rather
    than introduce another mouse click:
    ">
    Click to continue...</A>
    Am I missing something obvious? Any help would be appreciated...
    Thanks,
    -- Craig

  • Pros and Cons of putting jspx pages under WEB-INF

    Greetings All,
    I have been using JHeadstart release 10.1.3 Prod for a while now and was generating pages in various subdirectories under WEB-INF/pages/ and things are working fine.
    However, recently I came across a post in jDeveloper forum Re: Access JSF Pages within WEB-INF directory where Frank Nimphius has mentioned that there is no sense in putting JSP files that are used with JSF into WEB-INF.
    I know that in struts world it makes sense to put the jsp files under WEB-INF to prevent the users from directly accessing them and force them to access them only via struts actions/navigation rules; but in JSF world we anyway expose the jspx names to the user and in-fact if we keep the pages under WEB-INF the url to access the pages also contains 'faces/WEB-INF/...'
    Thus, I would like to get opinion from various experienced professionals participating in this forum and more so from JHeadStart team members on Pros and Cons of putting jspx pages under WEB-INF
    regards - rutwik

    Rutwik,
    From your reply it seems that, for now, there should not be any impact on us as long as we don't upgrade to JDeveloper 10.1.3.1, as anyway the current JHS version is not certified against it.
    Correct.
    However, to be compatible with future releases of JHS and JDeveloper, will it be good to change the location of pages in our JHeadStart definitions to move them a directories above the WEB-INF etc and re-run the JHeadStart generators?
    Yes.
    Or, will the patch take care of modifying the current JHeadStart definations?
    No, Service Update 1 has a different default value for the pages dir , it is now /pages/ instead of /WEB-INF/page/, that's all.
    Also, with this patch, will we be able to upgrade to jDeveloper 10.1.3.1, which we would like to do once we have a production release?
    Yes, Service Update 1 is compatible with JDev 10.1.3.1
    Steven Davelaar,
    JHeadstart Team.

  • Possible to put JSPs used by JSF in WEB-INF directory?

    I'm used to storing my JSPs in the WEB-INF directory so that they can only be accessed through a controller servlet and not directly. Does anyone know if this is possible with JSF?
    I have an application that has 3 pages. I want to force the user to go from page 1 to page 2 to page 3. I don't want the user to be able to jump straight to page 2 or 3 without first going through the previous pages. How can I acheive this using JSF?
    Furthermore, if the session times out while the user is on page 2 or 3 and they attempt to submit, I want the application to go back to page 1 (or, preferably a page that states that the session has timed out) and force them to start over.

    May be you should just restrict access to your *.jsp files and doing your logic by the beans and navigation rules?
        <security-constraint>
            <!-- This security constraint illustrates how JSP pages
                 with JavaServer Faces components can be protected from
                 being accessed without going through the Faces Servlet.
                 The security constraint ensures that the Faces Servlet will
                 be used or the pages will not be processed. -->
            <display-name>Restrict access to JSP pages</display-name>
            <web-resource-collection>
                <web-resource-name>
                    Restrict access to JSP pages
                </web-resource-name>
                <url-pattern>*.jsp</url-pattern>
            </web-resource-collection>
            <auth-constraint>
                <description>
                   With no roles defined, no access granted
                </description>
            </auth-constraint>
        </security-constraint>

  • Support for JSP's located in WEB-INF directory

    Several application servers support the use of placing JSP pages underneath the WEB-INF directory, to insure that only server side workflow forwards requests to those pages and not direct URL access. IN addition the JSTL specification supports the use of
    <c:import url="/WEBINF/published/campaign_Arts.jsp" />
    Does OC4J 9.0.3 support this syntax? I cannot get it to work. Is there an application configuration file I need to update to support this?
    Thanks

              thank you for your reply...
              but...
              My problem is that i want to serve jsp pages that include various other jsp pages.
              But i don't want those other pages to be served directly. The approach of putting
              the jsp files in the WEB-INF, or in a sub directory of it, worked fine on Tomcat.
              The way i look at it is that the server has direct access to them when putting
              togetter the main jsp, but they can't be accessed from the outside. But this seems
              not to be the case.
              Any ideas?
              "ilya Devers" <[email protected]> wrote:
              >The WEB-INF is not perceived as a directory to the engine. Resources
              >in it
              >are not exposed and should not. It can hold sensitive resources such
              >as
              >application deployment descriptors that can contain database log in
              >information to name something. The engine should never serve resources
              >located here.
              >
              >This directory should only contain the normal directories: lib and classes,
              >and the web.xml files (and weblogic.xml).
              >
              >Hope this helps.
              >
              >ilya
              >
              

  • Storing .jsp files in the web-inf directory

    Has anyone ever heard about storing JSP files in the web-inf directory instead of the web app root directory.
    Apparently it improves security.
    If this is so, how is the user suppose to access the jsp file since I thought that users were not able to access what is stored in the web-inf directory.
    Any thoughts
    Thanks
    Nat

    I didn't tyr this but I think it is possible. You can do it using <servlet-mapping/> as you do with any other servlet.
    For example include lines below, in web.xml of web-inf,
    <servlet>
    <servlet-name>ReportRouter</servlet-name>
    <jsp-file>/web-inf/jsp/ReportRouter.jsp</jsp-file>
    <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
    <servlet-name>ReportRouter</servlet-name>
    <url-pattern>/myrouter</url-pattern>
    </servlet-mapping>
    This may work. Don't you think so?
    Sudha

  • PLEASE HELP. How do you access properties files in WEB-INF  and classes directory

    We have a war file that needs to access properties files that are in the WEB-INF directory
    of the war file. We also need to load one of the properties files from the classpath.
    However, when we deploy the application ( an ear which inlcludes an ejbjar and a
    war and the libraries both the ejbjar (with a manifest setting the classpath ) and
    war need ) the properties don't get extracted.
    In some of our servlets we are trying to access those files with the path "WEB-INF/foo.properties"
    and we get a FileNotFoundException. Then we check and see that NO properties files
    have been extracted into their appropriate places ( not even those we throw into
    the WEB-INF/classes directory ).
    PLEASE HELP,
    Christian Hargraves

    The file doesn't have to be extracted from the war. For example, you can place
    test.properties into your app WEB-INF and write a simple JSP to see how it
    works:
    <%
    InputStream in = application.getResourceAsStream("/WEB-INF/test.properties");
    %>
    It will return you a zip inputstream if you deployed your application as a .war.
    Christian Hargraves <[email protected]> wrote:
    I try this, but I get a NullPointerException. The file never actually gets extracted
    from the war. Under tomcat and resin this works great ( that's why I am having all
    of the trouble i am having ), but there are absolutely no properties files in the
    extracted directories for WebLogic deploys. only:
    WEB-INF/some_tmp_dir/WEB-INF/lib
    and then some dynamically generated jor file with all of the classes that would normally
    go in WEB-INF/classes ( all except the properties, of course, which are no where
    to be found. ).
    There has to be some kind of setting I am missing. Please don't make me seperate
    these properties files from the war/ear and then put the path to these properties
    files in the CLASSPATH, changing one step to three steps to deploy!!
    I have found a documented bug where you can't even put the properties files in a
    jar file and that bug will never be fixed for WebLogic 6.1.
    "Dimitri I. Rakitine" <[email protected]> wrote:
    To access files in WEB-INF you can use ServletContext.getResourceXXX("/WEB-INF/filename")
    Christian Hargraves <[email protected]> wrote:
    We have a war file that needs to access properties files that are in theWEB-INF directory
    of the war file. We also need to load one of the properties files fromthe classpath.
    However, when we deploy the application ( an ear which inlcludes an ejbjarand a
    war and the libraries both the ejbjar (with a manifest setting the classpath) and
    war need ) the properties don't get extracted.
    In some of our servlets we are trying to access those files with the path"WEB-INF/foo.properties"
    and we get a FileNotFoundException. Then we check and see that NO propertiesfiles
    have been extracted into their appropriate places ( not even those wethrow into
    the WEB-INF/classes directory ).
    PLEASE HELP,
    Christian Hargraves--
    Dimitri
    Dimitri

  • Why cant I access a WEB-INF directory?

    Hi,
    I had a war file from a book that I did jar xvf on. It created a directory structure of the nature
    <TOMCAT>/ex0101/WEB-INF/etc...
    If I go to
    http://localhost:8080/ex0101it works
    If I create anotherDirectory inside ex0101, and do
    http://localhost:8080/ex0101/ANOTHER-DIRECTORYit works
    But If I do
    http://localhost:8080/ex0101/WEB-INFI get:
    HTTP Status 404 - /ex0101/WEB-INF/WHY?

    The WEB-INF directory is designated to be hidden from
    the end user. It is used for configuration files
    like web.xml, struts-config.xml, and other "utility"
    files. For security purposes, the end user is not
    allowed to browse this directory directly.oh thank you so much, I was sitting here going crazy, I looked at the directory property and it was not hidden on Windows, so I was so confused, but I guess it is hidden in Tomcat, thanks a lot, you are a truly kind man

  • Serializing a JavaBean to the WEB-INF directory or subdirectories

    Hello, I'm hoping someone can help me on this.
    I'm working with two scenarios in WSAD Enterprise Edition 5.0.0.2 for
    serializing a JavaBean (called AddressBean) to the following location
    in my Web application:
    /WEB-INF/classes/resources/serializable
    The data corresponding to the bean I'm serializing is being stored in
    a file with a name that makes it unique on the file system (e.g.
    jeff.ser, jill.ser). In the first scenario, I start by getting a
    FileOutputStream, then an ObjectOutputStream which is then used to
    write my JavaBean as needed. All of this is done in the first
    scenario from a JSP located in:
    myWebApp/Web Content/jsp/JSP1.jsp
    That works fine and as I'd expect. However, I'm not able to do that
    in the second scenario. In this scenario, I created an additional
    method in the bean itself that will actually serialize an object of
    its own type to the same directory structure that I showed above (i.e.
    under the WEB-INF directory). That is, in my bean, I have the
    following:
    public void writeDataToFile(AddressBean bean, String path) {
    FileOutputStream fos = null;
    ObjectOutputStream oos = null;
    try {
    fos = new FileOutputStream(path);
    oos = new ObjectOutputStream(fos);
    oos.writeObject(bean);
    oos.close();
    catch(Exception e) {
    e.printStackTrace();
    In this scenario, another JSP (call it JSP2.jsp) is creating an
    instance of AddressBean by using the jsp:useBean tag. The real path
    for the .ser file is figured out in the JSP code (same as was done in
    JSP1.jsp), and then I delegate the serialization part to the bean
    itself like so:
    // In JSP2.jsp
    <jsp:useBean id="ab" class="examples.beans.simple.AddressBean" />
    AddressBean address = (AddressBean) pageContext.getAttribute("ab");
    // get the path
    String path = ...
    String realPath = application.getRealPath(path);
    // write the object
    address.writeDataToFile(ab, realPath);
    What happens is that I get a FileNotFoundException while trying to
    create the FileOutputStream in the writeDataToFile() method in
    AddressBean at runtime. The message in the console states:
    java.io.FileNotFoundException:
    C:\WINNT\Profiles\myself\Personal\IBM\wsad\myworkbench\myWebApp\Web
    Content\ (Access is denied)
    The source file for AddressBean is located at:
    myWebApp/Java Source/examples.beans.simple.AddressBean
    WHAT is going on here!? I know that everything stored underneath the
    WEB-INF directory is not served to clients so I'm also assuming that
    whatever stored in that directory or its subdirectories is not
    accessible to clients by default. The only real difference between
    the two scenarios that I've described is that in the second one, the
    attempt to get a FileOutputStream is being made by a resource (i.e.
    AddressBean) that is outside of the "Web Content" directory structure
    in WSAD. However, the "Java Source" directory, which contains the
    package housing my AddressBean class, is also under myWebApp so I'm
    not seeing what the problem is at the moment.
    If anyone has any ideas, suggestions, solutions, please let me know.
    I'm stumped. Thank you!
    Jeff

    I figured it out, and it was my mistake. The problem was in a method defined in my AddressBean class that would take a String argument and use it to help create a unique file name (i.e. one with a .ser extension to contain the serialized bean data) for purposes of serialization later.
    Basically, I was using a local variable in the method unintentionally instead of the instance variable that I had defined in the bean so my path value was null at runtime--hence the FileNotFoundException.
    I'm still not sure why the (Access is denied) message was appearing, but I suspect it was b/c the absolute path that I'd end up with at runtime wasn't kosher; or, not having a destination .ser file was the problem.
    In any event, I fixed the mistake and could serialize a JavaBean in several ways:
    1. From a JSP directly
    2. By using a method defined in the JavaBean itself
    3. By passing on the request, which contained the JavaBean as an attribute, to a servlet that took care of the serialization
    Jeff

Maybe you are looking for