Avoid direct access to static content in webapps

Question

I have integrated my Spring MVC application Shiro for security reasons.

All my urls are working fine, but I have a few html pages which can be directly accessed.

How can I protect those pages, meaning if a user is not logged in to an application, and tries to open an html page, they should be redirected to the login page.

I have tested on jetty and tomcat server.

Jetty

http://ip:port - works fine, redirects to login page

http://ip:port/html/ - opens html pages

Tomcat

http://localhost:8070/my-app/html/myPage.html - opens html pages

Basically I do not want direct access of my static content without a user being logged in.

My html file is integrated with angular code. Is there any sort of servlet that can create and return html from it. Meaning I will read html from some other specific location, parse and return html in response.

html file location - my-app\\html\\myPage.html

Shiro settings in web.xml

filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy
        </filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>

    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

When i build war, it copies images, html folder outside web-inf also. How can avoid copying images, html folder outside web-inf using maven

Answer 1

您可以通过将其放在WEB-INF文件夹中来避免直接访问页面。

Answer 2

in shiro ini try

[url]

/*.html = authc

Following you can use but still recommended is to use from shiro.ini as you never know when your application grows and it would be unmanageable to do this from web.xml. It also makes web.xml fat this is for non spring. The configuration you are showing are only for shiro setup not for securing urls. For securing urls either you have to make them programmatically or from web.xml

<filter>
    <filter-name>ShiroFilter</filter-name>
    <filter-class>org.apache.shiro.web.servlet.IniShiroFilter</filter-class>
    <init-param><param-name>config</param-name><param-value>

    # INI Config Here

    [url]

    /*.html = authc



    </param-value></init-param>
</filter>