Question

I am running a web application in Tomcat server (OSGI based). I want to restrict the user from accessing URLs like

http://localhost:53307/myapp/servlet/startPage?PAGEURL=../../myapp/x/y/license.txt

I’ve configured web.xml as

 <security-constraint>
    <web-resource-collection>
        <web-resource-name>Lic</web-resource-name>
        <url-pattern>/x/y/*</url-pattern>
    </web-resource-collection>
   <auth-constraint />
</security-constraint>

This is still allowing the user to access the above URL. I think the URL pattern looks for the string starting after the context name. It’s not looking for matching values in the query string.

I want a configuration which prevents the user from accessing a URL (including the query string) that matches the configured value. Please help me configure it.

Answer 1

It’s working fine now. I made some mistake while testing.. The configuration above is fine