Home/ Questions/Q 8479369
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-10T19:00:13+00:00

In my web application, I use the .load() function in JQuery, to load some

  • 0

In my web application, I use the .load() function in JQuery, to load some JSP pages inside a DIV.

$("#myDiv").load("chat.jsp");

In chat.jsp, no Java codes is executed unless this client has Logged in, means, I check the session.

String sessionId = session.getAttribute("SessionId");
if(sessionId.equals("100")){
  //execute codes
}else{
  //redirect to log in page
}

Those java codes that will be executed, they will out.println(); some HTML elements.

I don’t want the client to write /chat.jsp in the browser to access this page, as it will look bad, and the other stuff in the main page won’t be there, and this could do a harm to the web app security.

How can I restrict someone from accessing chat.jsp directly, but yet keep it accessible via .load() ?

UPDATE:

JavaDB is a class that I made, it connects me to the Database.

This is chat.jsp

<body>

    <%

        String userId = session.getAttribute("SessionId").toString();
        if (userId != null) {
            String roomId = request.getParameter("roomId");
            String lastMessageId = request.getParameter("lastMessageId");
            JavaDB myJavaDB = new JavaDB();
            myJavaDB.Connect("Chat", "chat", "chat");
            Connection conn = myJavaDB.getMyConnection();
            Statement stmt = conn.createStatement();
            String lastId = "";
            int fi = 0;
            ResultSet rset = stmt.executeQuery("select message,message_id,first_name,last_name from users u,messages m where u.user_id=m.user_id and m.message_id>" + lastMessageId + " and room_id=" + roomId + " order by m.message_id asc");
            while (rset.next()) {
                fi = 1;
                lastId = rset.getString(2);
    %>
    <div class="message">
        <div class="messageSender">
            <%=rset.getString(3) + " " + rset.getString(4)%>
        </div>
        <div class="messageContents">
            <%=rset.getString(1)%>
        </div>
    </div>
    <%            }
    %>
    <div class="lastId">
        <% if (fi == 1) {%>
        <%=lastId%>
        <% } else {%>
        <%=lastMessageId%>
        <% }%></div>

    <% if (fi == 1) {%>
    <div class="messages">
    </div> 
    <% }
        } else {
            response.sendRedirect("index.jsp");
        }%>
</body>

Guys I don’t know what Filter means.

UPDATE

If I decided to send a parameter that tells me that this request came from Jquery.

.load("chat.jsp", { jquery : "yes" });

And then check it in chat.jsp

String yesOrNo = request.getParameter("jquery");

Then they can simply hack this by using this URL.

/chat.jsp?jquery=yes

or something like that..

UPDATE

I tried Maksim’s advice, I got this when I tried to access chat.jsp.

enter image description here

Is this the desired effect?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    In order to achieve this in my application I check for X-Requested-With field in http header the client sends to my page in its request. If its value is XMLHttpRequest, then it’s very likely that it came from an ajax request (jQuery appends this header to its requests), otherwise I don’t serve the page. Regular (direct) browser requests will leave this header field blank.

    In ASP.Net it looks like this, you will have to change your code slightly for JSP:

    if (Request.Headers["X-Requested-With"] != "XMLHttpRequest")
{
     Response.Write("AJAX Request only.");
     Response.End();
     return;
}

    UPD: After quick googling your code will probably be something like this

    if(!request.getHeader("X-Requested-With").equals("XMLHttpRequest")){
    out.println("AJAX Request only.");
    out.flush(); 
    out.close(); 
    return; 
}

    UPD2: Looks like request.getHeader("X-Requested-With") returns null in your case change the condition to something like this:

    String ajaxRequest = request.getHeader("X-Requested-With");
if(ajaxRequest == null || !ajaxRequest.equals("XMLHttpRequest")){
    ...
}
    • 0