需要幫助來理解和實現基本的web應用程序安全

Question

我正在從「頭第一個jsp和servlets」學習基本的web應用程序安全性。除了web.xml和tomcat-users.xml設置，安全應用程序沒有代碼。我跟着這本書，試圖製作自己的代碼，但我無法控制對我的網絡應用程序的訪問。

儘管在tomcat-users.xml中設置了角色並編輯了web.xml，但任何人都可以訪問它。請幫我理解這一點，並完成我的例子。我使用Eclipse kepler和Tomcat 6.0。

Eclipse項目：

後市展望：運行start.html並單擊submit button訪問SecureServlet。容器應該要求您登錄才能訪問該servlet。如果登錄名與web.xml設置中的登錄名相匹配，則會顯示secret.jsp頁。

輸出：沒有安全措施。您可以在不輸入任何登錄信息的情況下看到secret.jsp。

的Tomcat-users.xml中：

<tomcat-users> 

<role rolename="Admin"/> 
<role rolename="Member"/> 
<role rolename="Guest"/> 

<user username="jim" password="admin" roles="Admin, Member, Guest" /> 
<user username="tim" password="premium" roles="Member, Guest" /> 
<user username="fred" password="regular" roles="Guest" /> 

</tomcat-users> 

web.xml中： 把兩個tomcat的web.xml中的代碼和我的web應用程序的web.xml是安全的。

<web-app> 
    <security-constraint> 
    <web-resource-collection> 
     <web-resource-name>WebSecurity</web-resource-name> 
     <url-pattern>/secretServlet</url-pattern> 
     <http-method>GET</http-method> 
     <http-method>POST</http-method> 
    </web-resource-collection> 
    <auth-constraint> 
     <role-name>Admin</role-name> 
     <role-name>Member</role-name> 
    </auth-constraint> 
    </security-constraint> 
    <security-role> 
    <role-name>Admin</role-name> 
    </security-role> 
    <security-role> 
    <role-name>Member</role-name> 
    </security-role> 
    <security-role> 
    <role-name>Guest</role-name> 
    </security-role> 
    <login-config> 
    <auth-method>BASIC</auth-method> 
    </login-config> 

    <!--If web app web. xml, then add the mapping below--> 
    <servlet> 
    <description></description> 
    <display-name>SecretServlet</display-name> 
    <servlet-name>SecretServlet</servlet-name> 
    <servlet-class>foo.SecretServlet</servlet-class> 
    </servlet> 
    <servlet-mapping> 
    <servlet-name>SecretServlet</servlet-name> 
    <url-pattern>/SecretServlet</url-pattern> 
    </servlet-mapping> 

</web-app> 

的Html頁面開始：

Enter here:<br> 
<form method=post action="/WebSecurity/SecretServlet" > 
    <input type="submit" name="submit" value="try to access!"> 
</form> 

的Servlet：

package foo; 

import java.io.IOException; 

import javax.servlet.RequestDispatcher; 
import javax.servlet.ServletException; 
import javax.servlet.http.HttpServlet; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 

public class SecretServlet extends HttpServlet { 
    private static final long serialVersionUID = 1L; 

    public SecretServlet() { 
     super(); 
    } 


    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
     RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp"); 
     view.forward(request, response); 
    } 


    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
     RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp"); 
     view.forward(request, response); 
    } 

} 

secret.jsp：

<h3>Congratulations ! You entered the secure area.</h3> 

Answer 1

更改<url-pattern>如下，並嘗試

<url-pattern>/*</url-pattern>