Security Guide

Preventing Direct Access to Portal Application Resources

You can control visitor access to portal resources using visitor entitlements in the WebLogic Portal Administration Console. However, you must also use deployment descriptors to secure the JSPs and page flows contained in a portlet; otherwise a malicious user can access those resources directly if they know the correct URL.

This chapter contains the following section:

Securing Resources Using Deployment Descriptors

You must use J2EE security to prevent direct access to JSPs and page flows; otherwise, a user can access those resources directly by entering the correct URL.

Scoped roles are defined in their respective deployment descriptors.

An example URL to a JSP is:

http://emp_app/employmentPortal/portlets/hr/vpSalaries.jsp

To prevent direct access to portlets, add a security entry in your portal web project’s /WEB-INF/web.xml file. Listing 4-1 shows an example web.xml file.

!-- Use declarative security to block direct address to portlets -->

<security-constraint>

   <display-name>Default Portlet Security Constraints</display-name>

      <web-resource-collection>

      <web-resource-name>Portlet Directory</web-resource-name>

      <url-pattern>/portlets/*</url-pattern>

      <http-method>GET</http-method>

      <http-method>POST</http-method>

   </web-resource-collection>

<auth-constraint>

   <role-name>Admin</role-name>

</auth-constraint>

<user-data-constraint>

   <transport-guarantee>NONE</transport-guarantee>

</user-data-constraint>

</security-constraint>

This security entry in the web.xml file protects all files in the portal web project's /portlet directory and its subdirectories from being directly accessed using a request URL.

These protected resources are still displayed in entitled portlets, but only for users entitled to access those portlets.

Resources such as images, which do not require security restrictions, must be stored in unsecured directories outside the /portlets directory.