java - 如何防止直接 URL 访问操作类

Question

<分区>

Answer 1

j2ee 中内置了安全约束。您可以在 web.xml 中配置您不想允许直接访问的 URL 模式..

阅读这里 http://java.dzone.com/articles/understanding-web-security

Source :

用例:我们想从任何访问中排除一组网络资源。当 Web 应用程序的特定部分需要进行某种形式的维护或不适用于通用 Web 应用程序的特定物理部署时，就会出现这种情况。我们将通过不指定任何角色的授权约束来实现这一点。

<security-constraint>
   <display-name>excluded</display-name>
   <web-resource-collection>
      <web-resource-name>No Access</web-resource-name>
      <url-pattern>/excluded/*</url-pattern>
      <url-pattern>/restricted/employee/excluded/*</url-pattern>
      <url-pattern>/restricted/partners/excluded/*</url-pattern>
   </web-resource-collection>
   <web-resource-collection>
      <web-resource-name>No Access</web-resource-name>
      <url-pattern>/restricted/*</url-pattern>
      <http-method>DELETE</http-method>
      <http-method>PUT</http-method>
      <http-method>HEAD</http-method>
      <http-method>OPTIONS</http-method>
      <http-method>TRACE</http-method>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
   </web-resource-collection>
   <auth-constraint />
   <user-data-constraint>
      <transport-guarantee>NONE</transport-guarantee>
   </user-data-constraint>
</security-constraint>