Re: INSECURE to rely on sendRedirect (??)

[Erik Price]

Craig R. McClanahan wrote:

If you're sending a redirect from a servlet (or a filter) via Java code,
you must do a "return" statement afterwards to avoid sending the rest of
the content that would otherwise be sent:

  response.sendRedirect(...);
  return;

Thanks for your confirmation on this.

Same thing goes if you are (shudder) doing the redirect from within a JSP
page:

  <%
    response.sendRedirect(...);
    return;
  %>

I gather from your posts (this and others) that you're not a fan of putting decision logic in the JSPs!! :)


Erik


--
To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>