Security-constraint web.xml url-pattern safety

Question

I was wondering if the following configuration would be safe:

Webpages accessible at locations /ManageXXXX.do, /ManageYYYY.do, ... should only be able to be accessed by admin role, every other page is available to anyone.

I have configured the web.xml file as such:

     <security-constraint>
        <web-resource-collection>
            <url-pattern>/Manage*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>admin</role-name>    
        </auth-constraint>  
    </security-constraint>

Now I was wondering how reliable this was to people trying to get past the security. Is this guaranteed to block my Manage* pages from unauthorized users? I'd just like to know how safe this kind of pattern matching is.

Michael · Accepted Answer · 2013-05-23 12:25:55Z

1

From Servlet API Specification: http://www.jcp.org/aboutJava/communityprocess/mrel/jsr154/

SRV.11.2 Specification of Mappings
In the Web application deployment descriptor, the following syntax is used to define
mappings:
• A string beginning with a ‘/’ character and ending with a ‘/*’ suffix is used for path mapping.
• A string beginning with a ‘*.’ prefix is used as an extension mapping.
• A string containing only the ’/’ character indicates the "default" servlet of
the application. In this case the servlet path is the request URI minus the con-
text path and the path info is null.
• All other strings are used for exact matches only.

According to Servlet API Specification the pattern /Manage* is “exact matches only” and it is not what you want. Please move all resources for role admin to /Manage/ and configure pattern <url-pattern>/Manage/*</url-pattern>

answered May 23, 2013 at 12:25

Michael

10.3k20 gold badges72 silver badges111 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

arnehehe Over a year ago

Strange, because the way I have it set up now it's handling security correctly with the url-pattern set as /Manage* for pages such as /ManageX.do, /ManageY.do etc.

Michael Over a year ago

As you see it is copy from the specification :) Please ensure that users without admin role can not access it

arnehehe Over a year ago

I have verified that users without admin role cannot access any of the /Manage* pages.

Michael Over a year ago

So, the implementation is not according to the specification :)

Collectives™ on Stack Overflow

Security-constraint web.xml url-pattern safety

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related