Possible to put JSPs used by JSF in WEB-INF directory?

I'm used to storing my JSPs in the WEB-INF directory so that they can only be accessed through a controller servlet and not directly. Does anyone know if this is possible with JSF?
I have an application that has 3 pages. I want to force the user to go from page 1 to page 2 to page 3. I don't want the user to be able to jump straight to page 2 or 3 without first going through the previous pages. How can I acheive this using JSF?
Furthermore, if the session times out while the user is on page 2 or 3 and they attempt to submit, I want the application to go back to page 1 (or, preferably a page that states that the session has timed out) and force them to start over.

May be you should just restrict access to your *.jsp files and doing your logic by the beans and navigation rules?
    <security-constraint>
        
        <display-name>Restrict access to JSP pages</display-name>
        <web-resource-collection>
            <web-resource-name>
                Restrict access to JSP pages
            </web-resource-name>
            <url-pattern>*.jsp</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <description>
               With no roles defined, no access granted
            </description>
        </auth-constraint>
    </security-constraint>

Similar Messages

Support for JSP's located in WEB-INF directory

Several application servers support the use of placing JSP pages underneath the WEB-INF directory, to insure that only server side workflow forwards requests to those pages and not direct URL access. IN addition the JSTL specification supports the use of
<c:import url="/WEBINF/published/campaign_Arts.jsp" />
Does OC4J 9.0.3 support this syntax? I cannot get it to work. Is there an application configuration file I need to update to support this?
Thanks

          thank you for your reply...
          but...
          My problem is that i want to serve jsp pages that include various other jsp pages.
          But i don't want those other pages to be served directly. The approach of putting
          the jsp files in the WEB-INF, or in a sub directory of it, worked fine on Tomcat.
          The way i look at it is that the server has direct access to them when putting
          togetter the main jsp, but they can't be accessed from the outside. But this seems
          not to be the case.
          Any ideas?
          "ilya Devers" <[email protected]> wrote:
          >The WEB-INF is not perceived as a directory to the engine. Resources
          >in it
          >are not exposed and should not. It can hold sensitive resources such
          >as
          >application deployment descriptors that can contain database log in
          >information to name something. The engine should never serve resources
          >located here.
          >
          >This directory should only contain the normal directories: lib and classes,
          >and the web.xml files (and weblogic.xml).
          >
          >Hope this helps.
          >
          >ilya
          >

Storing .jsp files in the web-inf directory

Has anyone ever heard about storing JSP files in the web-inf directory instead of the web app root directory.
Apparently it improves security.
If this is so, how is the user suppose to access the jsp file since I thought that users were not able to access what is stored in the web-inf directory.
Any thoughts
Thanks
Nat

I didn't tyr this but I think it is possible. You can do it using <servlet-mapping/> as you do with any other servlet.
For example include lines below, in web.xml of web-inf,
<servlet>
<servlet-name>ReportRouter</servlet-name>
<jsp-file>/web-inf/jsp/ReportRouter.jsp</jsp-file>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>ReportRouter</servlet-name>
<url-pattern>/myrouter</url-pattern>
</servlet-mapping>
This may work. Don't you think so?
Sudha

Access jsp pages in WEB-INF directory

Hi,
I've a problem with my jsp web project;
practically I've created a web project that uses jsp pages and servlet.
I never use links to jsp pages, directly in my web pages, but I call always first servlet;
the servlet call jsp pages.
My project is completed and works fine, but any user can access to my jsp pages directly simply writing the url.
So I've tried to move my jsp pages in the WEB-INF directory, but now I doesn't manage in accessing index.jsp page;
how must I do to access index.jsp page?
I've tried to modify web.xml like this
<welcome-file-list>
          <welcome-file>WEB-INF/index.jsp</welcome-file>
     </welcome-file-list>
but doesn't work;
besides also servlet calls to jsp pages doesn't work anymore.
How can I solve?
Thank you in advance
MargNat

ok, so first you have to implement the Filter interface, with 3 methods,
the main method u have to put logic in is doFilter()
public class YourClass implements javax.servlet.Filter {
doFilter(ServletRequest req, ServletResponse res, FIlterChain chain) throws ... {
//check first if is HTTP, if in this case permission is not granted as well
if(req instanceof HttpServletRequest{
HttpServletRequest httpReq = (HttpServletRequest)req;
//now check if its called for index.jsp
if(!httpReq.getRequestURI().toLowerCase().endsWith("index.jsp"))
   throw new ServletException("access permitted");
else
chain.doFilter(req,res); //go on with processing
}else
throw new ServletException("only HTTP requests allowed");
}and of course you have to register that filter in your web.xml doing
<filter>
    <filter-name>yourFilter</filter-name>
<filter-class>yourFilterClass</filter-class>
</filter>
<filter-mapping>
    <filter-name>yourFilter</filter-name>
    <url-pattern>/**.jsp</url-pattern>
</filter-mapping>actually that's it

Access JSF Pages within WEB-INF directory

Hi,
I am generating a project using JHeadstart 10.1.3
with the default setting for the UI Pages directory (/WEB-INF/page).
This means that the generated pages are placed in the page directory
within the WEB-INF directory.
The generated pages use ADF Faces and the problem is that I can't
get access to the pages in the WEB-INF directory
When I try to deploy to OC4J standalone, the pages in the WEB-INF directory
are not accessible.
I read that I have to construct a index.jspx file that forwards to
the first page (Home.jspx)
This is my index.jspx:
<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.0">
<jsp:scriptlet> request.getRequestDispatcher("WEB-INF/page/Home.jspx").forward(request,response);
</jsp:scriptlet>
</jsp:root>
This works, but I now have the problem of not getting a valid FacesContext:
500 Internal Server Error
javax.servlet.jsp.JspException: Cannot find FacesContext
at javax.faces.webapp.UIComponentTag.doStartTag(UIComponentTag.java:405)
at com.sun.faces.taglib.jsf_core.ViewTag.doStartTag(ViewTag.java:105)
at web2d_inf._page._Home_jspx._jspService(_Home_jspx.java:100)
[SRC:/WEB-INF/page/Home.jspx:9]
at com.orionserver[Oracle Containers for J2EE 10g (10.1.3.0.0) ].http.OrionHttpJspPage.service(OrionHttpJspPage.java:59)
at oracle.jsp.runtimev2.JspPageTable.compileAndServe(JspPageTable.java:662)
at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:370)
at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:478)
etc. etc.
What is the required way of setting up the forward (and having a valid FacesContext)?
I know that this is a JHeadstart problem, but maybe you guys know how to solve it.
Part of my web.xml:
<description>Empty web.xml file for Web Application</description>
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>client</param-value>
</context-param>
<context-param>
<param-name>javax.faces.CONFIG_FILES</param-name>
<param-value>/WEB-INF/faces-config.xml,/WEB-INF/custom-faces-config.xml,/WEB-INF/JhsCommon-beans.xml,/WEB-INF/AppModule-Breadcrumb-beans.xml,/WEB-INF/Bpas-beans.xml,/WEB-INF/BpasLookup-beans.xml,/WEB-INF/GroupsLookup-beans.xml,/WEB-INF/PersonsLookup-beans.xml,/WEB-INF/OrganizationsLookup-beans.xml</param-value>
</context-param>
<context-param>
<param-name>CpxFileName</param-name>
<param-value>sumawest.view.DataBindings</param-value>
</context-param>
<filter>
<filter-name>adfFaces</filter-name>
<filter-class>oracle.adf.view.faces.webapp.AdfFacesFilter</filter-class>
</filter>
<filter>
<filter-name>adfBindings</filter-name>
<filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jspx</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jspx</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<servlet-name>ordDeliverMedia</servlet-name>
</filter-mapping>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<servlet-name>ordDeliverMedia</servlet-name>
<servlet-class>oracle.ord.html.OrdPlayMediaServlet</servlet-class>
<init-param>
<param-name>releaseMode</param-name>
<param-value>Stateful</param-value>
</init-param>
</servlet>
<servlet>
<servlet-name>resources</servlet-name>
<servlet-class>oracle.adf.view.faces.webapp.ResourceServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>ordDeliverMedia</servlet-name>
<url-pattern>ordDeliverMedia</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>resources</servlet-name>
<url-pattern>/adf/*</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>35</session-timeout>
</session-config>
<mime-mapping>
<extension>html</extension>
<mime-type>text/html</mime-type>
</mime-mapping>
<mime-mapping>
<extension>txt</extension>
<mime-type>text/plain</mime-type>
</mime-mapping>
<welcome-file-list>
<welcome-file>index.jspx</welcome-file>
</welcome-file-list>

I do something similar in my index.jspx file - but I needed to add "faces" to the url path. This will have the faces servlet process it and setup the faces context.
Have you tried changing
request.getRequestDispatcher("WEB-INF/page/Home.jspx").forward(request,response);to
request.getRequestDispatcher("faces/WEB-INF/page/Home.jspx").forward(request,response);

Run jsp pages that are in WEB-INF folder

HI
I am using struts and
I moved my jsp pages from web content to Web-inf folder.
Now how do i access them .
thanks

Why did you put them in WEB-INF in the first place? What's using Struts do that makes you think you should?

How can I forward to a jsp under the WEB-INF directory?

I have a webapp with a jsp that forwards to a jsp called /WEB-INF/pages/secure.jsp When I try to forward to it, I get the error:
"trying to GET /mywebapp/WEB-INF/pages/secure.jsp, deny-existence reports: denying existence of /web/webapps/mywebapp/WEB-INF/pages/secure.jsp"
How can I forward to this page?
Thanks,
Micah

Craig - I'm trying to do something very similar - build a waiting page into the
flow. I've got a support case open (to get the BEA recommended approach) but so
far have had no luck. Let me know if you've found the answer - or are still struggling.
Cheers,
Niall
[email protected] (Craig Coffin) wrote:
I am trying to get a JSP in a portlet to forward to a Webflow URL,
without much success...
The following code produces the ubiquitous "Functionality temporarily
unavailable" message, presumably because jsp:forward chokes on the
absolute URL:
<c:set var="url">
<portlet:createWebflowURL event="next"/>
</c:set>
<%
// convert to a scripting variable for the jsp:forward tag
String url = (String) pageContext.getAttribute("url");
%>
<jsp:forward page="<%=url%>"/>
Using c:redirect fares little better. This code produces an empty
portlet:
<c:set var="url">
<portlet:createWebflowURL event="next"/>
</c:set>
<c:redirect url="${url}"/>
The closest I've been able to get is to have the user click a link to
get to the next page, but I'd like to have an automatic forward rather
than introduce another mouse click:
">
Click to continue...</A>
Am I missing something obvious? Any help would be appreciated...
Thanks,
-- Craig

Using a Variable from web-inf/web.xml in java code?

I would like to create a read-only variable with a value in the /web-inf/web.xml file and then access that value within a java service method within the Application Module.
Where / how do I read the value from the web.xml file and make it accessible within my java code?
thanks

Hi,
you can define context parameters in web.xml that you can access from Java in the web application
The following is a JSF examle that checks a context parameter in a PhaseListener, where the string is stored ina Java constant (could be "myParam")
ExternalContext exctx = FacesContext.getCurrentInstance().getExternalContext();
useSessionPageCache = exctx.getInitParameter(Constants.USE_PAGE_CACHE) == null ? false :
(exctx.getInitParameter(Constants.USE_PAGE_CACHE)).equalsIgnoreCase("TRUE") ? true : false;
From here you can call a method on the AM to set the value or look for another option.
Frank

Any one used hsql within tomcat web-inf before?

In hsql you have.
DB.script
DB.properties
DB.data
DB.backup
files
I want to be able to jdbc on the database within web-inf.
i.e jdbc:hsql:file:full_path/webapp/web-inf/DB
When I try this in my jsp or java bean it does not connect.
I want to be able to do this for security reasons because other directories can be reaced via http but web-inf can not.
Any ideas or anyone done this before?
Thanks in advance

can you create the jdbc url dynamically?
"jdbc:hsql:file:" +
application.getRealPath("WEB-INF/DB");
WEB-INF is usually all caps, BTW.
Why does it need to be in WEB-INF anyway?for security reasons to make the database it less accessible

Is it possible to put a Swing componet on the web?

Hi,
I have a Swing application which has I mean an application with GUI and would like to put on the web, is it possible? please provide examples if possible.
I appreciate your help
Jii

Yes, You can use Swing applets on the web, but not internet explorer does not support Swing.
It supports java 1.1.4 (but it is not compatible with java).

Pros and Cons of putting jspx pages under WEB-INF

Greetings All,
I have been using JHeadstart release 10.1.3 Prod for a while now and was generating pages in various subdirectories under WEB-INF/pages/ and things are working fine.
However, recently I came across a post in jDeveloper forum Re: Access JSF Pages within WEB-INF directory where Frank Nimphius has mentioned that there is no sense in putting JSP files that are used with JSF into WEB-INF.
I know that in struts world it makes sense to put the jsp files under WEB-INF to prevent the users from directly accessing them and force them to access them only via struts actions/navigation rules; but in JSF world we anyway expose the jspx names to the user and in-fact if we keep the pages under WEB-INF the url to access the pages also contains 'faces/WEB-INF/...'
Thus, I would like to get opinion from various experienced professionals participating in this forum and more so from JHeadStart team members on Pros and Cons of putting jspx pages under WEB-INF
regards - rutwik

Rutwik,
From your reply it seems that, for now, there should not be any impact on us as long as we don't upgrade to JDeveloper 10.1.3.1, as anyway the current JHS version is not certified against it.
Correct.
However, to be compatible with future releases of JHS and JDeveloper, will it be good to change the location of pages in our JHeadStart definitions to move them a directories above the WEB-INF etc and re-run the JHeadStart generators?
Yes.
Or, will the patch take care of modifying the current JHeadStart definations?
No, Service Update 1 has a different default value for the pages dir , it is now /pages/ instead of /WEB-INF/page/, that's all.
Also, with this patch, will we be able to upgrade to jDeveloper 10.1.3.1, which we would like to do once we have a production release?
Yes, Service Update 1 is compatible with JDev 10.1.3.1
Steven Davelaar,
JHeadstart Team.

Appc does not compile JSPs under WEB-INF

Hi,
          We are using WLS 8.1 and I noticed that appc does not compile jsps that are
          under WEB-INF. Is this expected? If the jsps are outside of WEB-INF then
          appc works fine...
          Thanks!
          John


Although the client is not allowed to directly access jsps under WEB-INF, it
          is perfectly acceptable (and often recommended) to use a front controller to
          forward to jsps. Often these jsps are "hidden" in the WEB-INF directory so
          that they can't be accessed directly by the client. This pattern works fine
          under 8.1 except that appc won't precompile the jsps under WEB-INF (the
          container does compile the jsps when they are called). I believe this is a
          bug... If jsps are allowed in WEB-INF then appc should compile them...
          John
          "Stjepan Brbot" <stjepan.brbot@@zg.hinet.hr> wrote in message
          news:[email protected]...
          > Yes, this is expected! Web container, or better to say it's web component,
          > does not serve content of WEB-INF directory directly mening you cannot
          > access jsp inside WEB-INF like
          http://host:port/WebApp/WEB-INF/something.jsp
          > hence there's no need for compiling JSP's in it! The content of WEB-INF
          > directory can be accessed only via internal links so it is mostly used for
          > referencing taglibs. JSPs, HTMLs, images and all other file type that has
          to
          > be accessible directly by client web-server (not container internally)
          > should be in application directory or one of it's subdirectories.
          >
          > "John Hampton" <[email protected]> wrote in message
          > news:[email protected]...
          > > Hi,
          > >
          > > We are using WLS 8.1 and I noticed that appc does not compile jsps that
          > are
          > > under WEB-INF. Is this expected? If the jsps are outside of WEB-INF
          then
          > > appc works fine...
          > >
          > > Thanks!
          > > John
          > >
          > >
          >

Does JSP best practice of putting under WEB-INF apply to JSF pages?

I'm new to JSF and wondering if the "best practice" advice that used to be given of storing your jsp pages under WEB-INF (when using Model2) to keep them from being served up without going through your controller still applies with JSF.
Since the component lifecycle is so different, I'm wondering if it would still apply? If anyone can explain why it might or might not apply I'd appreciate it!
Thanks!

The rule is:
keep all the pages you don�t user to "browse", under the WEB-INF directory.
MeTitus

JSPs using Custom Tag with Boolean attribute cannot compile

Hi,
In Oracle9iAS(9.0.3), a jsp using a tag extension, which has a Boolean attribute, caused the following compile error, although the jsp is valid in other web containers.
ERROR:
/opt/oracle/j2ee/home/application-deployments/simple/simple/persistence/_pages/_test.java:56: Method toBoolean(java.lang.Boolean) not found in class _test.
__jsp_taghandler_1.setExists( OracleJspRuntime.toBooleanObject( toBoolean( b)));
JSP:
<%@ page language="java" %>
<%@ page errorPage="error.jsp" %>
<%@ taglib prefix="jnpr" uri="/WEB-INF/testtag.tld" %>
<%
Boolean b = Boolean.valueOf("true");
%>
<jnpr:TestTag exists="<%= b%>"/>
The boolean value is <%= b %>
Tag Handler:
package defaultpak;
import javax.servlet.jsp.tagext.*;
import javax.servlet.jsp.*;
public class TestTag extends TagSupport{
private Boolean exists = null;
private java.lang.Boolean getExists() {
return exists;
public void setExists(java.lang.Boolean newExists) {
exists = newExists;
public int doStartTag() throws JspException {
return super.doStartTag();
Is this a known problem? Is there a way to get around this?
Thanks in advance.
Fred

This is a known issue with 903, fixed in coming 904.
In 903 the workaround is to use primitive type "boolean" instead of Object type "java.lang.Boolean" in user's getter and setter code for the taglib.
-Prasad

Unable to load Applet in JSP using Tomcat 5.5.12

Hi
I am aunable to applet in jsp using Tomcat 5.5.12 and JRE 1.5. Below is the code that I am using
                                   <applet
                                   codebase = "."
                                   archive = "WebPOSApplet.jar"
                                   code = "webposprint.WPMainApplet.class"
                                   name = "Trans Applet"
                                   width = "450"
                                   height = "115"
                                   hspace = "0"
                                   vspace = "0"
                                   align = "middle"
                                   >
<param name = "redirectInfo" value = "SearchProducts.do">
                                   </applet>
<%/*%>
<OBJECT
                                   classid = "clsid:CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA"
                                   codebase = "http://java.sun.com/products/plugin/autodl/jinstall-1_4_2-windows-i586.cab#Version=1,4,2,0"
                                   WIDTH = 450 HEIGHT = 115 >
<PARAM NAME = CODE VALUE = webposprint.WPMainApplet.class>
<PARAM NAME = archive VALUE = WebPOSApplet.jar>
<PARAM NAME = "type" VALUE = "application/x-java-applet;jpi-version=1.4.2">
<param name = "redirectInfo" value = "SearchProducts.do">
<PARAM NAME = "scriptable" VALUE = "false">
<PARAM NAME = model VALUE=models/buckminsterfullerine.xyz>
<embed width="450" height="115" code="webposprint.WPMainApplet.class" archive="WebPOSApplet.jar" type="application/x-java-applet;jpi-version=1.4.2" redirectinfo="SearchProducts.do" scriptable="false" model="models/buckminsterfullerine.xyz" src="webposprint.WPMainApplet.class">
</embed> <COMMENT> <EMBED
                                   type = "application/x-java-applet;jpi-version=1.4.2" \
                                   CODE = webposprint.WPMainApplet.class\
                                             archive = WebPOSApplet.jar\
                                   WIDTH = 373 \
                                   HEIGHT = 167 \
                                   model =models/buckminsterfullerine.xyz \
                                        scriptable = false \
                                        pluginspage = "http://java.sun.com/products/plugin/index.html#download"> <NOEMBED>
alt="Your browser understands the <APPLET>
tag but isn't running the applet, for some reason."
Your browser is completely ignoring the <APPLET>
tag! </NOEMBED> </EMBED> </COMMENT>
</OBJECT>
<%*/%>
This code doesn't seems working with Tomcat 5.5.12. I works fine with Tomcat 4.1.31
Please help
Thanks

Applets run client side - which means the relevant class files need to be downloaded to the client.
Anything under the WEB-INF directory is not directly accessible by the client. Nothing under WEB-INF can be downloaded.
ergo, specifying the WEB-INF directory as part of your applet codebase is a bad idea.
I would suggest try copying the applet classes from under WEB-INF to some other place in your application.
Also, you should probably specify the full class name of your Applet in the plugin tag.
<%@ page import="com.util.MyApplet" %>
<jsp:plugin type="applet" code="com.util.MyApplet" codebase="/classes" width="250" height="100" jreversion="1.6">
     <jsp:fallback>
          <B>Unable to start plugin!</B>
     </jsp:fallback>
</jsp:plugin>cheers,
evnafets

Possible to put JSPs used by JSF in WEB-INF directory?

Similar Messages

Maybe you are looking for