I need to prevent unauthorized users from accessing the application pages

Question

Hi^^,
I have created an application in jsp and servlets. It has several pages like manager, supervisor accountant. I need to prevent unauthorised users from accessing these pages. In other words I need to implement a filter. Anyone who types a url other than that of the login page needs to be blocked. However I am not able to conceptualize the code that is going to be inside the doFilter() method. Please help
Sincerely,
Prashant

Answer 1

Hi^^,
I admit that there were some mistakes in the previous posting. I have corrected the mistakes and now there is going to be no compile time error. However when i put in the login id and the password it is redirecting me to the login page. I think that the front end jsp is directing the control to the controller servlet. But as "YOU" have pointed out in your previous post,
"by default requestDispatcher.forward(...) does not pass through the filter change. If the user requests the login page from their browser however, then they will still get the error message, which may not be appropriate."
I feel we need to somehow make the code pass through the requestDispatcher.forward(...) method of the servlet.
I am again posting the corrected code.
package com;
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
public class SecurityFilter implements Filter
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws   ServletException, IOException
  HttpServletRequest req = (HttpServletRequest)request;
  HttpServletResponse res = (HttpServletResponse)response;
  String X = req.getRequestURI();
  if(X.equals(http://localhost:8080/MyProject/LoginPage.jsp))
     //writing code for passing through the filter
     final class MyGenericFilter implements javax.servlet.Filter
      public FilterConfig filterConfig;
      public void doFilter( final ServletRequest request, final ServletResponse response, FilterChain chain) throws java.io.IOExeption, javax.servlet.ServletException
      chain.doFilter(request,response);
      public void init(final FilterConfig filterConfig)
      this.filterConfig = filterConfig;
      public void destroy()
else
   HttpSession session = req.getSession();
   String username = (String)session.getAttribute("username");
   if(null==username)
     request.setAttribute("Error","Session has ended. Please login");
     RequestDispatcher rd = request.getRequestDispatcher("Login.jsp");
     rd.forward(request,response);
     chain.doFilter(request,response);
    else
     RequestDispatcher rd = request.getRequestDispatcher("X");
     rd.forward(request,response);
public void init(final FilterConfig filterConfig)throws ServletException
      public void destroy()
  Edited by: pksingh79 on Aug 12, 2008 5:23 AM