需要帮助来理解和实现基本的web应用程序安全

Question

我正在从“头第一个jsp和servlets”学习基本的web应用程序安全性。除了web.xml和tomcat-users.xml设置，安全应用程序没有代码。我跟着这本书，试图制作自己的代码，但我无法控制对我的网络应用程序的访问。

尽管在tomcat-users.xml中设置了角色并编辑了web.xml，但任何人都可以访问它。请帮我理解这一点，并完成我的例子。我使用Eclipse kepler和Tomcat 6.0。

Eclipse项目：

后市展望：运行start.html并单击submit button访问SecureServlet。容器应该要求您登录才能访问该servlet。如果登录名与web.xml设置中的登录名相匹配，则会显示secret.jsp页。

输出：没有安全措施。您可以在不输入任何登录信息的情况下看到secret.jsp。

的Tomcat-users.xml中：

<tomcat-users> 

<role rolename="Admin"/> 
<role rolename="Member"/> 
<role rolename="Guest"/> 

<user username="jim" password="admin" roles="Admin, Member, Guest" /> 
<user username="tim" password="premium" roles="Member, Guest" /> 
<user username="fred" password="regular" roles="Guest" /> 

</tomcat-users> 

web.xml中： 把两个tomcat的web.xml中的代码和我的web应用程序的web.xml是安全的。

<web-app> 
    <security-constraint> 
    <web-resource-collection> 
     <web-resource-name>WebSecurity</web-resource-name> 
     <url-pattern>/secretServlet</url-pattern> 
     <http-method>GET</http-method> 
     <http-method>POST</http-method> 
    </web-resource-collection> 
    <auth-constraint> 
     <role-name>Admin</role-name> 
     <role-name>Member</role-name> 
    </auth-constraint> 
    </security-constraint> 
    <security-role> 
    <role-name>Admin</role-name> 
    </security-role> 
    <security-role> 
    <role-name>Member</role-name> 
    </security-role> 
    <security-role> 
    <role-name>Guest</role-name> 
    </security-role> 
    <login-config> 
    <auth-method>BASIC</auth-method> 
    </login-config> 

    <!--If web app web. xml, then add the mapping below--> 
    <servlet> 
    <description></description> 
    <display-name>SecretServlet</display-name> 
    <servlet-name>SecretServlet</servlet-name> 
    <servlet-class>foo.SecretServlet</servlet-class> 
    </servlet> 
    <servlet-mapping> 
    <servlet-name>SecretServlet</servlet-name> 
    <url-pattern>/SecretServlet</url-pattern> 
    </servlet-mapping> 

</web-app> 

的Html页面开始：

Enter here:<br> 
<form method=post action="/WebSecurity/SecretServlet" > 
    <input type="submit" name="submit" value="try to access!"> 
</form> 

的Servlet：

package foo; 

import java.io.IOException; 

import javax.servlet.RequestDispatcher; 
import javax.servlet.ServletException; 
import javax.servlet.http.HttpServlet; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 

public class SecretServlet extends HttpServlet { 
    private static final long serialVersionUID = 1L; 

    public SecretServlet() { 
     super(); 
    } 


    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
     RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp"); 
     view.forward(request, response); 
    } 


    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
     RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp"); 
     view.forward(request, response); 
    } 

} 

secret.jsp：

<h3>Congratulations ! You entered the secure area.</h3> 

Answer 1

更改<url-pattern>如下，并尝试

<url-pattern>/*</url-pattern>