Hi, Perhaps I wasn't clear. The client does _not_ request the JSP directly - ever. All requests go through a front side controller servlet, and that servlet forwards to the appropriate JSP.
Section SRV9.5 of the Servlet 2.3 specification clearly states that clients cannot directly request resources under the WEB-INF directory. But it does say that Servlets and other server side resource do have access to the WEB-INF directory - via the getResource and getResourceAsStream methods. It does not specifically mention however, that the getRequestDispatcher method has access to the WEB-INF directory - perhaps this is where the confusion may be. In the section titled "Hide Resource from a Client" in the book "Core J2EE Patterns" (Alur et. al.), they suggest that if you use a front side controller (as I am) and then place all JSPs under the WEB-INF directory you have now made it impossible for a client to directly request a JSP - which is the desired affect that I want. All client requests go through the front side controller which has access to the WEB-INF directory and everything should be peaches! So there seems to be 3 possibilities: 1) the book is wrong, and the getRequestDispatcher method does not have access to the WEB-INF directory 2) or it is correct and I am doing something wrong 3) or both the book and I are correct and Weblogic is wrong. Has anyone tried this configuration before? Thanks, Craig -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 03, 2002 10:10 AM To: JDJList Subject: [jdjlist] Re: Issue with servlet forwarding on WLS 7 I just did a simple test on WebLogic 7.0 and for a JSP or a HTML page accessed directly through a browser I get the same 404 error. I don't believe that it will let you access anything under the WEB-INF folder through HTTP as it is not meant to be used for serving content files. I really doubt if any app server would allow access to anything under the WEB-INF directory to a HTTP/HTTPS request as it would mean that any class file, jar or any other resource would be accessible. Normally you wouldn't want this kind of behaviour for reasons that you have already pointed out. I couldn't find anything on BEA's site to confirm or deny my assumptions though.... HTH, Greg. Craig Dickson <[EMAIL PROTECTED]> on 2002/10/03 12:32:19 PM Please respond to "JDJList" <[EMAIL PROTECTED]> To: "JDJList" <[EMAIL PROTECTED]> cc: Subject: [jdjlist] Issue with servlet forwarding on WLS 7 Hi, I have a war file deployed on Weblogic 7. I have placed all of my jsp filesunder /WEB-INF/jsp as a security measure to control�direct client access to the JSPs. Allclient access is via a front controller servlet, which redirects to aparticular JSP based on criteria in the request.My problem is if I make a call something like this inside the controllerservlet: ... dispatcher = context.getRequestDispatcher("/WEB-INF/jsp/my.jsp"); dispatcher.forward(request, response); ... I get a 404 resource not found returned to the client. This should be reallysimple, so I am frustrated with this! What am I missing?This structure is detailed in the J2EE patterns book, but after going back and looking at the section again I realize there is a lot of hand waving and no code examples for this particular part. If I drop the leading slash from the path I get a NullPointerException, which according to the JavaDocs is the correct functionality - it explicitly states the path must begin with a slash and represents the path from the root of current context to the required JSP/servlet. I haven't had a chance to try this on another container yet, so perhaps this is a Weblogic quirk. Also as soon as I post this I am going to try and move the JSPs out from under the WEB-INF directory just to verify what the problem really is (ie. all forwarding is not working, or just forwarding to resources under WEB-INF). Of course having the JSPs out from under WEB-INF defeats the purpose of this exercise in the long run! Thanks, Craig ____________________________________________________ To change your JDJList options, please visit: http://www.sys-con.com/java/list.cfm Be respectful! Clean up your posts before replying ____________________________________________________ ____________________________________________________ To change your JDJList options, please visit: http://www.sys-con.com/java/list.cfm Be respectful! Clean up your posts before replying ____________________________________________________ ____________________________________________________ To change your JDJList options, please visit: http://www.sys-con.com/java/list.cfm Be respectful! Clean up your posts before replying ____________________________________________________
