Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL like,

Example: http://www.example.com/example/example.txt

User was able to do that without authentication. I have a simple dynamic web application in java. I know spring can achieve this task using tag but I doubt there is any way I can achieve the same using only the web.xml.

For information: the static content are located outside the WEB-INF folder.

Are there any suggestions of alternate ways I can safe guard my static content from being accessed by unauthorized users?

share|improve this question
Put a <security-constraint> in your web.xml. That's what they're for. –  planetlevel Jul 25 '13 at 21:46
add comment

2 Answers

You can disallow direct access to your static content, and then build a dynamic page that checks the authorisation, and then serves the content if the user is authorised.

For example http://www.example.com/static.jsp?content=example.txt

If you do this then be very careful that this page can only return content you want users to access, for example, don't allow users to do things like this: http://www.example.com/static.jsp?content=/etc/passwd or http://www.example.com/static.jsp?content=../WEB-INF/web.xml

I'd suggest using a white list of the static content that this page is permitted to return.

share|improve this answer
add comment

maybe your reverse-proxy infront of your app-server is configured to deliver static-content and dont know about permissions.

Are there any suggestions of alternate ways I can safe guard my static content from being accessed by unauthorized users?

you must deliver your static-content from your app-servers.

share|improve this answer
can you give me an example for that, I have no idea.I am using JBoss AS7 –  Prerit Jul 17 '13 at 17:00
for the app-server-part ask the devs, for for frontend-server-part it depends if and what you use; just make sure thate every request goas directly to you as. –  that guy from over there Jul 17 '13 at 19:30
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.