受保护的URL将Webapge的不受保护的组件泄漏给未经身份验证的用户

Question

I believe implementing security for a JSF application through <login-config> + <security-constraint> + <security-role> & through use of <filter> are two different ways !? Are they ?

I tried implementing security through the first method above(using <login-config> + <security-constraint> + <security-role> ) but found that my protected webpage that was using both protected & unprotected HTML components was delivered with unprotected resources even to the unauthenticated users.

I need to protect the URLs completely so that the protected URLs don't even leak any part of that webpage to the unauthenticated users. How do I go about that ?

And, is security implementation using <filter> in web.xml a self managed way to deal with security ? I believe then you can then customize security more fine-grained as you are filtering/catching each & every request ?

Answer 1

It are indeed two distinct ways. The <security-constraint> is part of container managed authentication (CMS). The Filter is part of homegrown authentication.

To restrict access to certain resources with CMS, you just have to set its <url-pattern> :

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Application</web-resource-name>
        <url-pattern>/app/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>someRoleName</role-name>
    </auth-constraint>
</security-constraint>

The above example puts the constraint on all URLs matching /app/* and allows access to users with someRoleName only.

To restrict access to certain resources with a Filter , you have to set its <url-pattern> as well:

<filter>
    <filter-name>authenticationFilter</filter-name>
    <filter-class>com.example.AuthenticationFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>authenticationFilter</filter-name>
    <url-pattern>/app/*</url-pattern>
</filter-mapping>

You only have to define roles elsewhere, perhaps as an <init-param> of the filter.