Should JSP and HTML pages be inside Web INF or Outsite WEB INF. There are some applications where JSP and HTML pages are kept inside web info,but generally java classes are inside SRC, web.xml is inside web-info.and JSP pages are in WEB Content but can JSP be in web-inf ?
Everything outside WEB-INF is publicly available no authentication is applied on that, but all resources inside WEB-INF is secured. You can keep static pages outside WEB-INF and dynamic pages like profiles,accounts inside WEB-INF.
Read the following to get more clarity.......
Java Server Pages (JSPs) is an extremely common UI view technology used in J2EE development. JSPs represent the interface the end user interacts with while using an application. JSPs also usually include some business logic, and frequently there are portions of a page protected by some authorization constraints. Additionally, there are many times other protections in request handling (controller) code that perform some authorization before forwarding users to a given JSP. Bottom line, there is important logic (and at times data) stored in JSPs that shouldn’t be generally accessible to end users without going through the appropriate controls to gain access to them.
Knowing that these resources are important to the application, we’d certainly like to protect them. In general, modern applications rely on frameworks that use an MVC model for accessing an application. What that practically means regarding JSPs is that there is no direct access to the JSP during normal use of the application. You make a request to some type of controller or handler that performs some business logic and then internally forwards to a JSP for rendering. This means JSPs are generally no longer directly accessed, at least on purpose. However, if you store your JSPs in an area accessible to the web without putting them in the WEB-INF (same place where your web.xml goes) directory, they can be directly browsed by users (unless you have other protections in place). This means your pages will most likely break functionally (since they won’t have certain data they are expecting to come from the controller), and they will often times not have the appropriate authorizations performed since those are often expected to occur when a user follows the path through the controller
Knowing that these resources are important to the application, we’d certainly like to protect them. In general, modern applications rely on frameworks that use an MVC model for accessing an application. What that practically means regarding JSPs is that there is no direct access to the JSP during normal use of the application. You make a request to some type of controller or handler that performs some business logic and then internally forwards to a JSP for rendering. This means JSPs are generally no longer directly accessed, at least on purpose. However, if you store your JSPs in an area accessible to the web without putting them in the WEB-INF (same place where your web.xml goes) directory, they can be directly browsed by users (unless you have other protections in place). This means your pages will most likely break functionally (since they won’t have certain data they are expecting to come from the controller), and they will often times not have the appropriate authorizations performed since those are often expected to occur when a user follows the path through the controller
No comments:
Post a Comment