Bugs item #621521, was opened at 2002-10-10 12:38 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=621521&group_id=22866
Category: JBossWeb Group: v3.0 Rabbit Hole >Status: Closed >Resolution: Fixed Priority: 5 Submitted By: Scott M Stark (starksm) Assigned to: Nobody/Anonymous (nobody) Summary: Jetty welcome-file security problem? Initial Comment: If the url of a welcome-file points to a resource that should be secured its content is displayed without requesting authentication. In the attached war, the following URLs should all require the login form to be displayed: http://localhost:8080/secure/ http://localhost:8080/secure/restricted/hello.html http://localhost:8080/secure/restricted/hello2.html Jetty is only displaying the login form for the second two URLs. The first URL which includes the http://localhost:8080/secure/restricted/hello.html content does not require authentication. Maybe this is a grey area of the servlet spec, but the jboss- 3.0.3_tomcat-4.0.5 bundle does not exhibit this behavior. It does display the login form when the http://localhost:8080/secure/ is accessed. ---------------------------------------------------------------------- >Comment By: Scott M Stark (starksm) Date: 2002-10-29 14:25 Message: Logged In: YES user_id=175228 The 3.0.4 release has the webdefault.xml available in the root of the unpackaged jbossweb.sar. Setting the redirectWelcome init-param of the default servlet to true provides the desired behavior. ---------------------------------------------------------------------- Comment By: Greg Wilkins (gregwilkins) Date: 2002-10-10 22:49 Message: Logged In: YES user_id=44062 There is some debate on the JSR about what the correct mechanism for welcome files is. Jetty uses requestdispatcher.forward by default, which bypasses security constraints. Some time ago, tomcat changed from similar to using a HTTP redirect to the welcome file. As it is the RI, we followed but only optionally. If you set redirectWelcome to true in the webdefaults.xml file, you will get the tomcat behaviour and security constraints will not be bypassed. I've suggested to Jules that we make the webdefaults.xml file more accessible.... ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=621521&group_id=22866 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Jboss-development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
