Securing a JSP call from within the OAF

Question

Dear All
I am calling a custom JSP file ($OA_HTML/test.jsp) from within the controller class of an OAF page using the pageContext.setForwardURL where the JSP file is registered as an AOL function, so therefore the first parameter of the setForwardURL call is the function name.
Now the whole reason of wrapping this JSP file around OAF, is to take advantage of OAF’s security framework and Apps Specific Functionality, so that we can perform various security checks and validation before proceeding with the call to the JSP page.
This is working fine and we are getting the desired result, however, there is nothing stopping someone from directly typing the call to the JSP into the browser and executing the JSP and effectively bypassing the OAF page/controller, e,g:
http://server.host.domain:port/OA_HTML/test.jsp
Now the question is, is there any way for us to either
·     Prevent a direct execution of the JSP from the URL, by placing some kind of special JSP commands, which intrinsically ties the JSP with the OA controller.
·     Inside JSP validate and authenticate a user.
·     Any other methodologies that will secure the JSP file.
Your help and Guidance is appreciated.
Thanks
Patrice

Answer 1

Actually there is AOL security u can use to validate whether the particular jsp is directly invoked or coming from secure session.You can use code like
WebAppsContext webAppsContext = WebRequestUtil.validateContext(request, response);
The validateContext method checks whether the session associated with the request and response streams is a valid one - if so it returns a properly validated context. If the session is invalid or expired, this will take care of displaying a login page to the user and the method will return null.
--Mukul