需要帮助来理解和实现基本的Web应用程序安全性

Question

我正在学习“头脑jsp和servlets”的基本Web应用程序安全性。除web.xml和tomcat-users.xml设置外，安全应用没有代码。我按照这本书尝试制作自己的代码，但我无法控制对我的网络应用程序的访问。

尽管在tomcat-users.xml中设置了角色并编辑web.xml，但任何人都可以访问它。请帮助我理解这一点并完成我的例子。我正在使用Eclipse kepler和Tomcat 6.0。

Eclipse项目：

期望：运行start.html并点击submit button访问SecureServlet。容器应该要求您登录以访问该servlet。如果登录信息与web.xml设置中的登录信息匹配，则会显示secret.jsp页面。

输出：没有安全措施。您无需输入任何登录信息即可查看secret.jsp。

Tomcat的users.xml中：

<tomcat-users>

<role rolename="Admin"/>
<role rolename="Member"/>
<role rolename="Guest"/>

<user username="jim" password="admin" roles="Admin, Member, Guest" />
<user username="tim" password="premium" roles="Member, Guest" />
<user username="fred" password="regular" roles="Guest" />

</tomcat-users>

的web.xml： 将代码放在tomcat的web.xml和我的web应用程序的web.xml中是安全的。

  <web-app> 
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>WebSecurity</web-resource-name>
      <url-pattern>/secretServlet</url-pattern>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>Admin</role-name>
      <role-name>Member</role-name>
    </auth-constraint>
  </security-constraint>
  <security-role>
    <role-name>Admin</role-name>
  </security-role>
  <security-role>
    <role-name>Member</role-name>
  </security-role>
  <security-role>
    <role-name>Guest</role-name>
  </security-role>
  <login-config>
    <auth-method>BASIC</auth-method>
  </login-config>

  <!--If web app web. xml, then add the mapping below-->
    <servlet>
    <description></description>
    <display-name>SecretServlet</display-name>
    <servlet-name>SecretServlet</servlet-name>
    <servlet-class>foo.SecretServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>SecretServlet</servlet-name>
    <url-pattern>/SecretServlet</url-pattern>
  </servlet-mapping>

</web-app>

Html起始页：

Enter here:<br>
<form method=post action="/WebSecurity/SecretServlet" >
    <input type="submit" name="submit" value="try to access!">
</form>

的Servlet

package foo;

import java.io.IOException;

import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class SecretServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    public SecretServlet() {
        super();
    }


    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp");
        view.forward(request, response);
    }


    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        RequestDispatcher view = request.getRequestDispatcher("/jsp/secret.jsp");
        view.forward(request, response);
    }

}

secret.jsp：

<h3>Congratulations ! You entered the secure area.</h3>

Answer 1

更改<url-pattern>，如下所示，然后尝试

<url-pattern>/*</url-pattern>