Exclude css & image resources in web.xml Security Constraint
- by Tiggles
I am using JSF2.1 and Glassfish 3.1.2.
I specify a security constraint to block everything:
<security-constraint>
<web-resource-collection>
<web-resource-name>Secured Content</web-resource-name>
<!-- Block all -->
<url-pattern>/*</url-pattern>
</web-resource-collection>
<!-- only users with at least one of these roles are allowed to access the secured content -->
<auth-constraint>
<role-name>ADMINISTRATOR</role-name>
</auth-constraint>
</security-constraint>
and have another to allow access a subset of pages and the resources:
<security-constraint>
<web-resource-collection>
<web-resource-name>Open Content</web-resource-name>
<!-- Allow subscribe -->
<url-pattern>/subscribe/*</url-pattern>
<url-pattern>/javax.faces.resource/*</url-pattern>
</web-resource-collection>
<!-- No Auth Contraint! -->
</security-constraint>
This works fine. However, is the following
<url-pattern>/javax.faces.resource/*</url-pattern>
the correct way to allow all resources?
I only did this by looking at the url that Facelets injects into the xhtml. Is there security holes with this approach?
Thanks.
