Storing .jsp files in the web-inf directory

Has anyone ever heard about storing JSP files in the web-inf directory instead of the web app root directory.
Apparently it improves security.
If this is so, how is the user suppose to access the jsp file since I thought that users were not able to access what is stored in the web-inf directory.
Any thoughts
Thanks
Nat

I didn't tyr this but I think it is possible. You can do it using <servlet-mapping/> as you do with any other servlet.
For example include lines below, in web.xml of web-inf,
<servlet>
<servlet-name>ReportRouter</servlet-name>
<jsp-file>/web-inf/jsp/ReportRouter.jsp</jsp-file>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>ReportRouter</servlet-name>
<url-pattern>/myrouter</url-pattern>
</servlet-mapping>
This may work. Don't you think so?
Sudha

Similar Messages

Support for JSP's located in WEB-INF directory

Several application servers support the use of placing JSP pages underneath the WEB-INF directory, to insure that only server side workflow forwards requests to those pages and not direct URL access. IN addition the JSTL specification supports the use of
<c:import url="/WEBINF/published/campaign_Arts.jsp" />
Does OC4J 9.0.3 support this syntax? I cannot get it to work. Is there an application configuration file I need to update to support this?
Thanks

          thank you for your reply...
          but...
          My problem is that i want to serve jsp pages that include various other jsp pages.
          But i don't want those other pages to be served directly. The approach of putting
          the jsp files in the WEB-INF, or in a sub directory of it, worked fine on Tomcat.
          The way i look at it is that the server has direct access to them when putting
          togetter the main jsp, but they can't be accessed from the outside. But this seems
          not to be the case.
          Any ideas?
          "ilya Devers" <[email protected]> wrote:
          >The WEB-INF is not perceived as a directory to the engine. Resources
          >in it
          >are not exposed and should not. It can hold sensitive resources such
          >as
          >application deployment descriptors that can contain database log in
          >information to name something. The engine should never serve resources
          >located here.
          >
          >This directory should only contain the normal directories: lib and classes,
          >and the web.xml files (and weblogic.xml).
          >
          >Hope this helps.
          >
          >ilya
          >

How to load/save a file in the WEB-INF?

how can i load and save files in the WEB-INF directory using servlet?

This doesn't save files. And in order to reuseability and maintainability, I'd rather use java.io and passing the path/filename around in File object.
You can retrieve the absolute path for "/WEB-INF" byString absoluteWebInfPath = getServletContext().getRealPath("/WEB-INF");Then you can use that to read/write files.
File file = new File(absoluteWebInfPath, "filename.ext");
InputStream input = FileUtil.read(file);
FileUtil.write(file, input);and so on.

How can I reference a dtd in the Web-Inf directory from an xml file?

Hi,
I've placed my test.xml and test.dtd files in the following
direcory (part of my web application)
weblogic\config\MyDomain\applications\sample\Web-inf
When I refer to the dtd from the xml file, as follows,
<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE application SYSTEM "test.dtd">
Weblogic tries to look for the dtd in the weblogic directory(the
place where I started the server from). How can I get it to read
the dtd in the Web-inf directory?
I'm using Weblogic6.0 SP1 on Windows NT 4.0
Thanks.

Two options:
1) Use SYSTEM "http://localhost:7001/sample/test.dtd"
2) Or use XML registry in WLS6.0
Cheers - Wei
"Paromita" <[email protected]> wrote in message
news:3aaff997$[email protected]..
>
Hi,
I've placed my test.xml and test.dtd files in the following
direcory (part of my web application)
weblogic\config\MyDomain\applications\sample\Web-inf
When I refer to the dtd from the xml file, as follows,
<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE application SYSTEM "test.dtd">
Weblogic tries to look for the dtd in the weblogic directory(the
place where I started the server from). How can I get it to read
the dtd in the Web-inf directory?
I'm using Weblogic6.0 SP1 on Windows NT 4.0
Thanks.

Serializing a JavaBean to the WEB-INF directory or subdirectories

Hello, I'm hoping someone can help me on this.
I'm working with two scenarios in WSAD Enterprise Edition 5.0.0.2 for
serializing a JavaBean (called AddressBean) to the following location
in my Web application:
/WEB-INF/classes/resources/serializable
The data corresponding to the bean I'm serializing is being stored in
a file with a name that makes it unique on the file system (e.g.
jeff.ser, jill.ser). In the first scenario, I start by getting a
FileOutputStream, then an ObjectOutputStream which is then used to
write my JavaBean as needed. All of this is done in the first
scenario from a JSP located in:
myWebApp/Web Content/jsp/JSP1.jsp
That works fine and as I'd expect. However, I'm not able to do that
in the second scenario. In this scenario, I created an additional
method in the bean itself that will actually serialize an object of
its own type to the same directory structure that I showed above (i.e.
under the WEB-INF directory). That is, in my bean, I have the
following:
public void writeDataToFile(AddressBean bean, String path) {
FileOutputStream fos = null;
ObjectOutputStream oos = null;
try {
fos = new FileOutputStream(path);
oos = new ObjectOutputStream(fos);
oos.writeObject(bean);
oos.close();
catch(Exception e) {
e.printStackTrace();
In this scenario, another JSP (call it JSP2.jsp) is creating an
instance of AddressBean by using the jsp:useBean tag. The real path
for the .ser file is figured out in the JSP code (same as was done in
JSP1.jsp), and then I delegate the serialization part to the bean
itself like so:
// In JSP2.jsp
<jsp:useBean id="ab" class="examples.beans.simple.AddressBean" />
AddressBean address = (AddressBean) pageContext.getAttribute("ab");
// get the path
String path = ...
String realPath = application.getRealPath(path);
// write the object
address.writeDataToFile(ab, realPath);
What happens is that I get a FileNotFoundException while trying to
create the FileOutputStream in the writeDataToFile() method in
AddressBean at runtime. The message in the console states:
java.io.FileNotFoundException:
C:\WINNT\Profiles\myself\Personal\IBM\wsad\myworkbench\myWebApp\Web
Content\ (Access is denied)
The source file for AddressBean is located at:
myWebApp/Java Source/examples.beans.simple.AddressBean
WHAT is going on here!? I know that everything stored underneath the
WEB-INF directory is not served to clients so I'm also assuming that
whatever stored in that directory or its subdirectories is not
accessible to clients by default. The only real difference between
the two scenarios that I've described is that in the second one, the
attempt to get a FileOutputStream is being made by a resource (i.e.
AddressBean) that is outside of the "Web Content" directory structure
in WSAD. However, the "Java Source" directory, which contains the
package housing my AddressBean class, is also under myWebApp so I'm
not seeing what the problem is at the moment.
If anyone has any ideas, suggestions, solutions, please let me know.
I'm stumped. Thank you!
Jeff

I figured it out, and it was my mistake. The problem was in a method defined in my AddressBean class that would take a String argument and use it to help create a unique file name (i.e. one with a .ser extension to contain the serialized bean data) for purposes of serialization later.
Basically, I was using a local variable in the method unintentionally instead of the instance variable that I had defined in the bean so my path value was null at runtime--hence the FileNotFoundException.
I'm still not sure why the (Access is denied) message was appearing, but I suspect it was b/c the absolute path that I'd end up with at runtime wasn't kosher; or, not having a destination .ser file was the problem.
In any event, I fixed the mistake and could serialize a JavaBean in several ways:
1. From a JSP directly
2. By using a method defined in the JavaBean itself
3. By passing on the request, which contained the JavaBean as an attribute, to a servlet that took care of the serialization
Jeff

How to access the file in the WEB-INF Folder

hi..
i want to access a xml file, using servlet, which is placed under WEB-INF folder.
Please tell me how can i access the file.
I am using WSAD to develop the application
Thanx in advance.

I haven't tried accessing an XML file that is placed in WEB-INF folder.
Files under WEB-INF are usually protected from client/browser access, but a Servlet may be able to access it (not sure though).
What problems are you facing when you try to access an XML file in the WEB-INF folder?
If you can't access it from the WEB-INF folder , place it in any folder except the WEB-INF folder.
Also, if you want to protect the XML file then you could password protect it or deny access to it via .htaccess file, or simply return a 403 forbidden header.

How to display an image located in the WEB-INF directory?

Basically, When a user registers, they a directory is created with their username that holds images that they can upload. How do I display those images. All I am holding in the database is the location of the images.
ive tried
<img src="/WEB-INF/users/testuser/picture.jpg" />
but this doesnt work and for obvious security reasons shouldnt.. but is there another way of doing what i want to do? perhaps a custom tag? thanks
Jazz

You would have to write a generic servlet that would return an image
<img src="/getImage?user=testuser&pic=picture.jpg" />Your servlet would basically fetch the file from under web-inf, and then stream it back to the user.
Methods to use:
servletContext.getRealPath() (to help find the file on disk), relative to your web app
getOutputStream (as opposed to getWriter)
It is only in this way that you can access files on the server outside of the public web directories.
Hope this helps
Cheers,
evnafets

How can I forward to a jsp under the WEB-INF directory?

I have a webapp with a jsp that forwards to a jsp called /WEB-INF/pages/secure.jsp When I try to forward to it, I get the error:
"trying to GET /mywebapp/WEB-INF/pages/secure.jsp, deny-existence reports: denying existence of /web/webapps/mywebapp/WEB-INF/pages/secure.jsp"
How can I forward to this page?
Thanks,
Micah

Craig - I'm trying to do something very similar - build a waiting page into the
flow. I've got a support case open (to get the BEA recommended approach) but so
far have had no luck. Let me know if you've found the answer - or are still struggling.
Cheers,
Niall
[email protected] (Craig Coffin) wrote:
I am trying to get a JSP in a portlet to forward to a Webflow URL,
without much success...
The following code produces the ubiquitous "Functionality temporarily
unavailable" message, presumably because jsp:forward chokes on the
absolute URL:
<c:set var="url">
<portlet:createWebflowURL event="next"/>
</c:set>
<%
// convert to a scripting variable for the jsp:forward tag
String url = (String) pageContext.getAttribute("url");
%>
<jsp:forward page="<%=url%>"/>
Using c:redirect fares little better. This code produces an empty
portlet:
<c:set var="url">
<portlet:createWebflowURL event="next"/>
</c:set>
<c:redirect url="${url}"/>
The closest I've been able to get is to have the user click a link to
get to the next page, but I'd like to have an automatic forward rather
than introduce another mouse click:
">
Click to continue...</A>
Am I missing something obvious? Any help would be appreciated...
Thanks,
-- Craig

How to read resource file under the WEB-INF through ClassPathResource

I have an xml file under the directory WEB-INF but WEB-INF/classes, I want to read it through ClassPathResource class from Spring, and where I read this xml file is not in a Servlet class, how can I do? Thank you.

Webmethods should be able to handle it. if not you should convert the tline content into one xstring and pass it to webmethods.
othe option
if you are on WAS6.20 and above you can use BSP to achieve what you are looking for.
Regards
Raja

Access jsp pages in WEB-INF directory

Hi,
I've a problem with my jsp web project;
practically I've created a web project that uses jsp pages and servlet.
I never use links to jsp pages, directly in my web pages, but I call always first servlet;
the servlet call jsp pages.
My project is completed and works fine, but any user can access to my jsp pages directly simply writing the url.
So I've tried to move my jsp pages in the WEB-INF directory, but now I doesn't manage in accessing index.jsp page;
how must I do to access index.jsp page?
I've tried to modify web.xml like this
<welcome-file-list>
          <welcome-file>WEB-INF/index.jsp</welcome-file>
     </welcome-file-list>
but doesn't work;
besides also servlet calls to jsp pages doesn't work anymore.
How can I solve?
Thank you in advance
MargNat

ok, so first you have to implement the Filter interface, with 3 methods,
the main method u have to put logic in is doFilter()
public class YourClass implements javax.servlet.Filter {
doFilter(ServletRequest req, ServletResponse res, FIlterChain chain) throws ... {
//check first if is HTTP, if in this case permission is not granted as well
if(req instanceof HttpServletRequest{
HttpServletRequest httpReq = (HttpServletRequest)req;
//now check if its called for index.jsp
if(!httpReq.getRequestURI().toLowerCase().endsWith("index.jsp"))
   throw new ServletException("access permitted");
else
chain.doFilter(req,res); //go on with processing
}else
throw new ServletException("only HTTP requests allowed");
}and of course you have to register that filter in your web.xml doing
<filter>
    <filter-name>yourFilter</filter-name>
<filter-class>yourFilterClass</filter-class>
</filter>
<filter-mapping>
    <filter-name>yourFilter</filter-name>
    <url-pattern>/**.jsp</url-pattern>
</filter-mapping>actually that's it

Log4J - reading properties file from /WEB-INF directory issue..

I'm just learning to implement Log4J; the approach I am taking for my JSF application running under Tomcat 5.5x is to create an initialization servlet to initialize the logger, and then access the logger instance within my backing beans and application module services. I include log4j.jar file in /WEB-INF/lib and log4j.properties in /WEB-INF.
First I wanted to see if this was a good approach, and secondly I'm having trouble accessing the log4j.properties file from the /WEB-INF directory (see below) - any suggestions on how to set up the path so that the properties file can be found (I receive a java.io.filenotfoundexception)?
Where I'm looking for direction is how to define a single instance of the logger and then access that instance from my java classes versus re-creating the logger in each class.
----- web.xml --------
<servlet>
<servlet-name>LogServlet</servlet-name>
<servlet-class>com.sidehire.view.util.LogServlet</servlet-class>
<init-param>
<param-name>setup</param-name>
<param-value>/WEB-INF/log4j.properties</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
------ LogServlet class ------
public void init()
throws ServletException {
String config = getInitParameter("setup");
PropertyConfigurator.configure(config);
Thanks
Message was edited by:
javaX

Try to put the log4j.properties in your WEB-INF/classes/ directory.
You could wrap one log4j instance in a static method in a utility class, but then you would probably lose other information depending on your logger configuration.
If you create an instance in each class, which after all is just one line like this:
static Logger logger = Logger.getLogger(ChangePasswrdAction.class.getName());
then you are able to get time and method information.

Possible to put JSPs used by JSF in WEB-INF directory?

I'm used to storing my JSPs in the WEB-INF directory so that they can only be accessed through a controller servlet and not directly. Does anyone know if this is possible with JSF?
I have an application that has 3 pages. I want to force the user to go from page 1 to page 2 to page 3. I don't want the user to be able to jump straight to page 2 or 3 without first going through the previous pages. How can I acheive this using JSF?
Furthermore, if the session times out while the user is on page 2 or 3 and they attempt to submit, I want the application to go back to page 1 (or, preferably a page that states that the session has timed out) and force them to start over.

May be you should just restrict access to your *.jsp files and doing your logic by the beans and navigation rules?
    <security-constraint>
        
        <display-name>Restrict access to JSP pages</display-name>
        <web-resource-collection>
            <web-resource-name>
                Restrict access to JSP pages
            </web-resource-name>
            <url-pattern>*.jsp</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <description>
               With no roles defined, no access granted
            </description>
        </auth-constraint>
    </security-constraint>

BC4J, JSP, Apache: Deployment to web-inf

I'm trying to deploy a BC4J JSP application to a web-inf directory. In other words I'm using the OracleJSP extensions that support the globals.jsa application/session context.
When I place my application's BC4J jar file in the \approot\web-inf\lib directory it doesn't work. When I try a simple app with no BC4J its works. ie. My JSP works and it can load classes from both \approot\web-inf\classes and \approot\web-inf\lib\??.jar.
If I place the application BC4J jar file in \approot\web-inf\lib it can't find files such as \bc4jpackage\common\bc4j.xcfg. Therefore I think OracleJSP will load classes from \web-inf but because its not really in the JServ classpath BC4J wont find any other files.
Anyone tried this? Is there a workaround?

Hi,
I am yet another victim of the age-old error JBO:33001 bc4j.xcfg file not found in class path, When i have my BC4JApp.jar in Tomcat Web-inf/lib directory. All the other jar files and class files in my webserver-application web-inf classes and lib directory works.
But Tomcat server is not able to read this bc4j.xcfg file. I can see in my jar file that this bc4j.xcfg exists and in the specified package directory. still the problem persists. My BC4JApp.jar is perfectly working when i use JDeveloper. but not when i use tomcat4.0 and call a JSP using BC4JApp.jar from browser (My environment is Jdeveloper3.2, Tomcat4.0+IIS in middle tier and oracle 8i as DB, everything on windows2k)
I have gone through almost all the threads possible that relates to this error in this form. None of them have a answer except to say "put the file in classpath". and last reply is "will fix in jDeveloper 9i. So what happens to us who are working in Jdeveloper 3.2?
1. I have this file in my jar file.
2. I also tried creating a seperate directory manually, with the same name as my package under web-inf/classes, web-inf/lib , just under web-inf directory and atlast under approot directory also. I tried having my package directory containing bc4j.xcfg in these folders one at a time and also tried having this directory in all these folders at the same time.
Still no solution.
Itz frustrating that neither proper documentation nor a right url page nor i am aware of available addressing this. page links given in above threads only gives me the wonderful page of ie's "Page cannot be displayed".
Is there a answer to this error and my problem. If this doesn't work, then i have to all the way develop from scratch creating my jsp using JDBC calls and Stored packages etc.
I don't want to give up on this Jdeveloper at this final moment because if this bc4j.xcfg file is found, my application will work perfectly. on these final moments, if this doesn't work, i am frightened to imagine to develop my application in standard way. Atlast, if thatz the option left,we have to do that bcos our production date is close by.
Please can some one in this forum or Jdeveloper help me to solve this problem. I am desperate and very urgent.
Waiting for a reply from Jdev team very much...
Thanks
Hari(2/3/02)

Access JSF Pages within WEB-INF directory

Hi,
I am generating a project using JHeadstart 10.1.3
with the default setting for the UI Pages directory (/WEB-INF/page).
This means that the generated pages are placed in the page directory
within the WEB-INF directory.
The generated pages use ADF Faces and the problem is that I can't
get access to the pages in the WEB-INF directory
When I try to deploy to OC4J standalone, the pages in the WEB-INF directory
are not accessible.
I read that I have to construct a index.jspx file that forwards to
the first page (Home.jspx)
This is my index.jspx:
<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.0">
<jsp:scriptlet> request.getRequestDispatcher("WEB-INF/page/Home.jspx").forward(request,response);
</jsp:scriptlet>
</jsp:root>
This works, but I now have the problem of not getting a valid FacesContext:
500 Internal Server Error
javax.servlet.jsp.JspException: Cannot find FacesContext
at javax.faces.webapp.UIComponentTag.doStartTag(UIComponentTag.java:405)
at com.sun.faces.taglib.jsf_core.ViewTag.doStartTag(ViewTag.java:105)
at web2d_inf._page._Home_jspx._jspService(_Home_jspx.java:100)
[SRC:/WEB-INF/page/Home.jspx:9]
at com.orionserver[Oracle Containers for J2EE 10g (10.1.3.0.0) ].http.OrionHttpJspPage.service(OrionHttpJspPage.java:59)
at oracle.jsp.runtimev2.JspPageTable.compileAndServe(JspPageTable.java:662)
at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:370)
at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:478)
etc. etc.
What is the required way of setting up the forward (and having a valid FacesContext)?
I know that this is a JHeadstart problem, but maybe you guys know how to solve it.
Part of my web.xml:
<description>Empty web.xml file for Web Application</description>
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>client</param-value>
</context-param>
<context-param>
<param-name>javax.faces.CONFIG_FILES</param-name>
<param-value>/WEB-INF/faces-config.xml,/WEB-INF/custom-faces-config.xml,/WEB-INF/JhsCommon-beans.xml,/WEB-INF/AppModule-Breadcrumb-beans.xml,/WEB-INF/Bpas-beans.xml,/WEB-INF/BpasLookup-beans.xml,/WEB-INF/GroupsLookup-beans.xml,/WEB-INF/PersonsLookup-beans.xml,/WEB-INF/OrganizationsLookup-beans.xml</param-value>
</context-param>
<context-param>
<param-name>CpxFileName</param-name>
<param-value>sumawest.view.DataBindings</param-value>
</context-param>
<filter>
<filter-name>adfFaces</filter-name>
<filter-class>oracle.adf.view.faces.webapp.AdfFacesFilter</filter-class>
</filter>
<filter>
<filter-name>adfBindings</filter-name>
<filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jspx</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jspx</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<servlet-name>ordDeliverMedia</servlet-name>
</filter-mapping>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<servlet-name>ordDeliverMedia</servlet-name>
<servlet-class>oracle.ord.html.OrdPlayMediaServlet</servlet-class>
<init-param>
<param-name>releaseMode</param-name>
<param-value>Stateful</param-value>
</init-param>
</servlet>
<servlet>
<servlet-name>resources</servlet-name>
<servlet-class>oracle.adf.view.faces.webapp.ResourceServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>ordDeliverMedia</servlet-name>
<url-pattern>ordDeliverMedia</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>resources</servlet-name>
<url-pattern>/adf/*</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>35</session-timeout>
</session-config>
<mime-mapping>
<extension>html</extension>
<mime-type>text/html</mime-type>
</mime-mapping>
<mime-mapping>
<extension>txt</extension>
<mime-type>text/plain</mime-type>
</mime-mapping>
<welcome-file-list>
<welcome-file>index.jspx</welcome-file>
</welcome-file-list>

I do something similar in my index.jspx file - but I needed to add "faces" to the url path. This will have the faces servlet process it and setup the faces context.
Have you tried changing
request.getRequestDispatcher("WEB-INF/page/Home.jspx").forward(request,response);to
request.getRequestDispatcher("faces/WEB-INF/page/Home.jspx").forward(request,response);

Why cant I access a WEB-INF directory?

Hi,
I had a war file from a book that I did jar xvf on. It created a directory structure of the nature
<TOMCAT>/ex0101/WEB-INF/etc...
If I go to
http://localhost:8080/ex0101it works
If I create anotherDirectory inside ex0101, and do
http://localhost:8080/ex0101/ANOTHER-DIRECTORYit works
But If I do
http://localhost:8080/ex0101/WEB-INFI get:
HTTP Status 404 - /ex0101/WEB-INF/WHY?

The WEB-INF directory is designated to be hidden from
the end user. It is used for configuration files
like web.xml, struts-config.xml, and other "utility"
files. For security purposes, the end user is not
allowed to browse this directory directly.oh thank you so much, I was sitting here going crazy, I looked at the directory property and it was not hidden on Windows, so I was so confused, but I guess it is hidden in Tomcat, thanks a lot, you are a truly kind man

Storing .jsp files in the web-inf directory

Similar Messages

Maybe you are looking for