Web.xml安全约束不起作用 [英] Web.xml Security Constraints not working
问题描述
尝试不断完善我的网络应用程序的安全性.
Trying to get the security aspect of my web app up and going.
我已经在eclipse中创建了一个动态Web应用程序,并尝试使用基于表单的身份验证设置.
I've created a dynamic web application within eclipse and am trying to use a form based authentication setup.
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="3.0"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
<display-name>Application</display-name>
<context-param>
<param-name>javax.ws.rs.Application</param-name>
<param-value>com.foo.bar.webservices.MyApplication</param-value>
</context-param>
<context-param>
<param-name>resteasy.servlet.mapping.prefix</param-name>
<param-value>/resteasy</param-value>
</context-param>
<listener>
<listener-class>org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap</listener-class>
</listener>
<servlet>
<servlet-name>Resteasy</servlet-name>
<servlet-class>org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher</servlet-class>
</servlet>
<servlet>
<display-name>LoginServlet</display-name>
<servlet-name>LoginServlet</servlet-name>
<servlet-class>httpAuth.LoginServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Resteasy</servlet-name>
<url-pattern>/resteasy/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>LoginServlet</servlet-name>
<url-pattern>/LoginServlet</url-pattern>
</servlet-mapping>
<welcome-file-list>
<welcome-file>/login.jsp</welcome-file>
</welcome-file-list>
<security-constraint>
<display-name>Authorized Only</display-name>
<web-resource-collection>
<web-resource-name>Authorized Only</web-resource-name>
<url-pattern>/restricted/*</url-pattern>
<http-method>GET</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<description>Allowed users</description>
<role-name>USER</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/logonError.jsp</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>USER</role-name>
</security-role>
</web-app>
但是,当我部署并转到http://localhost:8080/Application/restricted/index.jsp
时,它显示了它不应该执行的操作.
However, when I deploy and go to http://localhost:8080/Application/restricted/index.jsp
it shows, which it shouldn't do.
进行了更改,以删除/Application.这样做在诸如/restricted/index.jsp
EDIT 1: Have made change to remove /Application. Doing so does not hold on pages such as /restricted/index.jsp
Application
+build
-WebContent
+css
+img
+js
login.jsp
logonError.jsp
+META-INF
-restricted
index.jsp
+WEB-INF
推荐答案
似乎您应用了错误的 url-pattern .尝试更改此内容
It seems that you are applying the wrong url-pattern. Try changing this
<url-pattern>/Application/restricted/*</url-pattern>
以此
<url-pattern>/restricted/*</url-pattern>
这篇关于Web.xml安全约束不起作用的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!