Question

I’m developing a web project with Java EE using JBoss 5. My WebContent folder has a .css file, used by all JSP (placed in other subfolders of WebContent). I want to forbid direct access to the .css file, but still be able to use it in my JSPs. I tried with

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Direct access to .css forbidden</web-resource-name>
    <url-pattern>/Style.css</url-pattern>
  </web-resource-collection>
  <auth-constraint/>
</security-constraint>

in web.xml descriptor, but this way JSPs are unable to use it.

Any ideas?

Answer 1

Any attempt to hide the CSS used on a page from the end-user is completely pointless.

You could check the HTTP_REFERER header and not display the CSS if it doesn’t match the page that embedded the style sheet.

But not even that will help in modern browsers, where the CSS is visible in the DOM inspector, and clickable with the correct referer set.

The browser needs to see the CSS in order to render it, hence there is no protection measure that will help. The best you can do (but it requires you changing your HTML) is obfuscate the CSS so there are no legible element names any more (e.g. .xweudhd instead of .top_navigation).

But I would drop the idea altogether. There are more productive ways to spend one’s time.