6

This is my first question here (so be gentle :)). I've looked everywhere and cant find the answer to my problem (also went a little crazy in the process).

I'm using Tomcat 7 and latest Eclipse IDE for Java EE developers (Eclipse platform 3.7.2 and Java EE IDE 1.4.2). So, I get this error: "The requested resource () is not available" while accessing http://127.0.0.1:8080/myTest/WEB-INF/jsp/savename.jsp. I've checked many many times that this file is on the disk in exact folder. I've tried running Tomcat inside Eclipse and deploying exported .war in Tomcat. Every time the same error pops up.

My files:

myTest/index.jsp
myTest/WEB-INF/html/GetName.html
myTest/WEB-INF/jsp/savename.jsp

When I run "http://localhost/myTest" index.jsp always runs properly. Then I use

"<jsp:forward page="WEB-INF/html/GetName.html"></jsp:forward>"

inside my index.jsp to navigate to GetName.html and that also works. The problem pops up in GetName.html:

<form  action='WEB-INF/jsp/savename.jsp' method="post" >
What's your name? <INPUT TYPE=TEXT NAME=username SIZE=20>
<P><INPUT TYPE=SUBMIT>
</form>

When i press submit button in the form, the browser redirects to: http://127.0.0.1:8080/myTest/WEB-INF/jsp/savename.jsp and the error pops up.

So I really don't understand why this is happening... Default Tomcat apps work perfectly...

P.S. I have tried also manualy navigating to files:

http://127.0.0.1:8080/myTest/WEB-INF/html/GetName.html
http://127.0.0.1:8080/myTest/WEB-INF/jsp/savename.jsp

but I also get the error (even when idex.jsp also navigates to GetName.html without any problems)..

Any help is much apreciated! Thanks!!

1 Answer 1

4

You can't directly navigate to any files/artifacts placed under WEB-INF directory (also valid for META-INF). This is a security feature of the servlet engine: content under WEB-INF is protected and not accessible from "outside" via URLs. Else, anybody could read sensitive details like application/database configuration, etc. by just assembling appropriate URLs.

The reason why the "jsp:forward" tag is still able to access files in/under WEB-INF directory is that the forward performs internally on the server, i.e. the request has already arrived to the servlet engine and index.jsp is executed, therefore the servlet engine has fulfilled it's security duties and now the author of e.g. index.jsp is responsible to decide which files have to be accessed.

PS
Besides using "jsp:forward" tags, you can use the include directive (static include), e.g.

<%@ include file=”/WEB-INF/dir/file.extension” %>

or the include JSP tag (dynamic include), e.g.

<jsp:include page=”/WEB-INF/dir/file.extension” />

The differences between these two include types can be googled, good results would be e.g. http://java.sun.com/products/jsp/tags/11/syntaxref117.html
http://java.sun.com/products/jsp/tags/11/syntaxref1112.html
http://www.coderanch.com/how-to/java/IncludesActionDirective
http://docs.oracle.com/cd/B14099_17/web.1012/b14014/keydev.htm#i1005631

4
  • Thanks man! But the problem still persists... How can I link different files inside different folders? Why the form in the GetName.html can't access WEB-INF/jsp/savename.jsp? What would be the solution? (except putting all files in the root directory...)
    – MoD
    Mar 1, 2012 at 18:11
  • 1
    Sorry to say, but with plain JSPs there isn't another solution. The form data is sent by the browser, so the browser assembles the URL and sends the data to the server using that URL, and the server says "NO, you can't get into WEB-INF". Therefore you have to put savename.jsp in the root directory, or another directory under the root directory, and to use include tags or directives to load the real content from files under WEB-INF.
    – t0r0X
    Mar 1, 2012 at 18:36
  • 3
    I think I know what you're trying achieve: protecting/hiding all JSPs and related code. As I said that can't be done with plain JSPs. You need to build a servlet or a filter which serves as "gateway" and is mapped to a URI not in/below WEB-INF, and which forwards the requests to your JSPs inside WEB-INF. I'd rather recommend using a framework which offers you such capabilities, like e.g. Spring MVC framework. Let me give you some pointers: static.springsource.org/spring/docs/current/…
    – t0r0X
    Mar 1, 2012 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.