java - 需要帮助来理解和实现基本的 Web 应用程序安全性

Question

我正在从“head first jsp and servlets”学习基本的网络应用程序安全性。除了 web.xml 和 tomcat-users.xml 设置外，安全应用程序没有任何代码。我按照这本书尝试编写自己的代码，但我无法控制对我的 Web 应用程序的访问。

尽管在 tomcat-users.xml 中设置角色并编辑 web.xml，但任何人都可以访问它。请帮助我理解这一点并完成我的例子。我正在使用 Eclipse kepler 和 Tomcat 6.0。

Eclipse 项目:

预期:运行start.html并单击提交按钮以访问SecureServlet。容器应该要求您登录以访问该 servlet。如果登录名与 web.xml 设置中的匹配，则会显示 secret.jsp 页面。

输出:没有安全措施。无需登录即可查看secret.jsp

Tomcat-用户.xml:

<tomcat-users>

<role rolename="Admin"/>
<role rolename="Member"/>
<role rolename="Guest"/>

<user username="jim" password="admin" roles="Admin, Member, Guest" />
<user username="tim" password="premium" roles="Member, Guest" />
<user username="fred" password="regular" roles="Guest" />

</tomcat-users>

web.xml:将代码放在 tomcat 的 web.xml 和我的网络应用程序的 web.xml 中是安全的。

  <web-app> 
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>WebSecurity</web-resource-name>
      <url-pattern>/secretServlet</url-pattern>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>Admin</role-name>
      <role-name>Member</role-name>
    </auth-constraint>
  </security-constraint>
  <security-role>
    <role-name>Admin</role-name>
  </security-role>
  <security-role>
    <role-name>Member</role-name>
  </security-role>
  <security-role>
    <role-name>Guest</role-name>
  </security-role>
  <login-config>
    <auth-method>BASIC</auth-method>
  </login-config>

  <!--If web app web. xml, then add the mapping below-->
    <servlet>
    <description></description>
    <display-name>SecretServlet</display-name>
    <servlet-name>SecretServlet</servlet-name>
    <servlet-class>foo.SecretServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>SecretServlet</servlet-name>
    <url-pattern>/SecretServlet</url-pattern>
  </servlet-mapping>

</web-app>

Html 起始页:

Enter here:<br>
<form method=post action="/WebSecurity/SecretServlet" >
    <input type="submit" name="submit" value="try to access!">
</form>

小服务程序:

package foo;

import java.io.IOException;

import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class SecretServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    public SecretServlet() {
        super();
    }


    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp");
        view.forward(request, response);
    }


    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp");
        view.forward(request, response);
    }

}

secret .jsp:

<h3>Congratulations ! You entered the secure area.</h3>

Answer 1

更改 <url-pattern>如下所示并尝试

<url-pattern>/*</url-pattern>