apache - 安全约束 web.xml url 模式安全

Question

我想知道以下配置是否安全:

在 /ManageXXXX.do、/ManageYYYY.do 位置可访问的网页，...应该只能由 admin 访问角色，每个其他页面对任何人都可用。

我已经这样配置了 web.xml 文件:

     <security-constraint>
        <web-resource-collection>
            <url-pattern>/Manage*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>admin</role-name>    
        </auth-constraint>  
    </security-constraint>

现在我想知道这对于试图通过安检的人来说有多可靠。这是否可以保证阻止未经授权的用户访问我的 Manage* 页面？我只想知道这种模式匹配的安全性。

Answer 1

来自 Servlet API 规范: http://www.jcp.org/aboutJava/communityprocess/mrel/jsr154/

SRV.11.2 Specification of Mappings
In the Web application deployment descriptor, the following syntax is used to define
mappings:
• A string beginning with a ‘/’ character and ending with a ‘/*’ suffix is used for path mapping.
• A string beginning with a ‘*.’ prefix is used as an extension mapping.
• A string containing only the ’/’ character indicates the "default" servlet of
the application. In this case the servlet path is the request URI minus the con-
text path and the path info is null.
• All other strings are used for exact matches only.

根据 Servlet API 规范，模式 /Manage*是“仅精确匹配”，这不是您想要的。请将角色管理员的所有资源移动到/Manage/并配置模式 <url-pattern>/Manage/*</url-pattern>