Stopping director access to pages

Question

How do I stop a user from directly accessing a jsp page (i.e. I only want a
          user to be able to visit a page via a jsp:forward from another page).
          Thanks,
          SB
          

Answer 1

Right. In weblogic 700 you can simply define a security constraint
          with an empty auth constraint in it (ie no roles specified). That
          should restrict direct access.
          <security-constraint>
          <web-resource-collection>
          <web-resource-name>Forbidden JSPs</web-resource-name>
          <url-pattern>*.jsp</url-pattern>
          </web-resource-collection>
          <auth-constraint/>
          </security-constraint>
          --Vinod.
          "Dimitri I. Rakitine" <[email protected]> wrote in message
          news:[email protected]...
          > You can use empty security role - direct access will be prohibited,
          > but access via requestdispatcher from the controller servlet will
          > work:
          >
          > <web-app>
          > ...
          > <security-constraint>
          > <display-name>Forbidden JSPs</display-name>
          > <web-resource-collection>
          > <web-resource-name>Forbidden JSPs</web-resource-name>
          > <url-pattern>*.jsp</url-pattern>
          > </web-resource-collection>
          > <auth-constraint>
          > <role-name>absolutely_not</role-name>
          > </auth-constraint>
          > </security-constraint>
          > ...
          > </web-app>
          >
          >
          > Stanley Beamish <[email protected]> wrote:
          > > How do I stop a user from directly accessing a jsp page (i.e. I only
          want a
          > > user to be able to visit a page via a jsp:forward from another page).
          >
          > > Thanks,
          > > SB
          >
          > --
          > Dimitri
          >