|
|
Re: Jsp protection
|
Posted: Dec 8, 2003 5:16 PM
|
|
What I would suggest is subclass the RequestProcessor and do some session validation there. Say when someone logs in store some specific information in the Session about the user. When subsequent request comes, check the session object for the stored information in the Sub classed RequestProcessor. That way someone just can't type in a URL and gain access to the system. Here is something I came up with
public class CustomRequestProcessor extends RequestProcessor {
public CustomRequestProcessor() {
super();
}
protected boolean processPreprocess(HttpServletRequest req, HttpServletResponse res) {
boolean continueProcess = true;
if (req.getServletPath().indexOf("login")>0 || req.getServletPath().indexOf("Welcome")>0){
return continueProcess;
}else{
HttpSession session = req.getSession(false);
if (session.getAttribute(IConstants.USER_VIEW_KEY) == null){
continueProcess = false;
ForwardConfig config = moduleConfig.findForwardConfig("SessionTimeOut");
try {
res.sendRedirect(req.getContextPath() + config.getPath());
}
catch (IOException ex) {
}
}
}
return continueProcess;
}
}
|
|
Previous Topic
