Re: filter-mapping
Christopher Schultz <chris-Nf+wZpSdgwfUvtVhod0YCwZWvwf/[email protected]> Wed, 11 Feb 2009 15:36:22 -0500
| Newsgroups | gmane.comp.java.securityfilter.user |
|---|---|
| Message-ID | <[email protected]> |
This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --===============1309778313147819197== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enigF11582223EE71F480CF6C71B" This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigF11582223EE71F480CF6C71B Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Martin, On 2/11/2009 1:19 PM, Martin Dubuc wrote: > I have experimented with security-filter the last few days and although= it > solves some of the issues I was trying to fix for a long time, there ar= e > things I can't do anymore with this filter in place. >=20 > One area of concern is CGI scripts. I use CGI emulation in Tomcat to ru= n > some legacy CGI scripts and it looks like these scripts are not compati= ble > with the security-filter. I also have some issues with some files, for > instance the error.jsp file that should be displayed when an exception = is > thrown. Currently, when an exception occurs, the login form is presente= d > instead of error.jsp (it looks like the system redirects to login.jsp > instead of error.jsp). If you are getting login.jsp showing instead of error.jsp, then you probably have your <security-constraint> elements (in securityfilter-config.xml) set to something too restrictive. Remember if error.jsp is protected, you'll be forced to login before you can see it ;= ) Can you explain a little more about the CGI stuff? I don't see why securityfilter would be interfering with your CGI scripts. Can you give me some more details? > I thought I might be able to get around these problems by specifying a > filter mapping, but I can't get that to work. I would like to have the > security filter applied only on files that end with the jsf extension (= for > instance main.jsf), but I can't get this to work. If I specify a filter= > mapping /main.jsf, I can never get out of the login page (after I submi= t the > login page, the system redisplays the login page again and again). Ther= e are > no error logs reported in the catalina.out file. > > Even specifying a filter mapping of *.jsf does not work. If I specify t= he > following filter: >=20 > <filter-mapping> > <filter-name>Security Filter</filter-name> > <url-pattern>*.jsf</url-pattern> > </filter-mapping> >=20 > I get an HTTP status 404 when I try to access any page in my applicatio= n. This looks like a legitimate filter mapping, and should only apply to *.jsf files (see section 11 of the servlet spec for more information). Are saying that a filter-mapping for /main.jsf causes all pages to redirect to the login page no matter what? That's odd, since securityfilter should only be kicking-in for requests to /main.jsf. And, if you use a filter-mapping of *.jsp then everything 404s? Hmm... if securityfilter were actually failing, I would expect a 500 Internal Server Error, not a 404. Do you have container-managed security set up in Tomcat's server.xml as well as securityfilter? That might be confusing things. Remember that securityfilter-config.xml should contain all your <security-constraint> setup, and web.xml should have none of this stuff leftover. Otherwise, you'll have sf and Tomcat fighting each other. Also note that you'll have to map j_security_check to securityfilter, otherwise you'll never be able to log in ;) > When I run certain CGI scripts, I get this log: > INFO: cgi: runCGI: bad header line "<html><head><meta http-equiv=3D"ref= resh" > content=3D"0;URL=3D/system/login.jsp"></head></html> >=20 > It looks like when I try to run this script, the application redirects = to > login.jsp first and this confuses the CGI emulator. securityfilter uses 302 FOUND HTTP responses to perform redirections, not META HTTP-EQUIV tricks. Whatever you are seeing here is coming from somewhere else. > Some other CGI scripts, the application just transitions to the login p= age > and I don't see any error or info logs in catalina.out. >=20 > Do you understand what might be happening and is there a solution? Honestly, I have no idea what's going on. Let's get some more info. Try to keep your responses on the mailing list. -chris --------------enigF11582223EE71F480CF6C71B Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmTNsYACgkQ9CaO5/Lv0PDlUwCeIlBWRHSRAhBhAMeTdYuEq9GV BqIAn2NlLn9G3W+tCWAPcKssnaMCx4Fm =Mlut -----END PGP SIGNATURE----- --------------enigF11582223EE71F480CF6C71B-- --===============1309778313147819197== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Create and Deploy Rich Internet Apps outside the browser with Adobe(R)AIR(TM) software. With Adobe AIR, Ajax developers can use existing skills and code to build responsive, highly engaging applications that combine the power of local resources and data with the reach of the web. Download the Adobe AIR SDK and Ajax docs to start building applications today-http://p.sf.net/sfu/adobe-com --===============1309778313147819197== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ securityfilter-user mailing list securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org https://lists.sourceforge.net/lists/listinfo/securityfilter-user --===============1309778313147819197==--