I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL like,

Example: http://www.example.com/example/example.txt

User was able to do that without authentication. I have a simple dynamic web application in java. I know spring can achieve this task using tag but I doubt there is any way I can achieve the same using only the web.xml.

For information: the static content are located outside the WEB-INF folder.

Are there any suggestions of alternate ways I can safe guard my static content from being accessed by unauthorized users?

  • 1
    Put a <security-constraint> in your web.xml. That's what they're for. Commented Jul 25, 2013 at 21:46

1 Answer 1


You can disallow direct access to your static content, and then build a dynamic page that checks the authorisation, and then serves the content if the user is authorised.

For example http://www.example.com/static.jsp?content=example.txt

If you do this then be very careful that this page can only return content you want users to access, for example, don't allow users to do things like this: http://www.example.com/static.jsp?content=/etc/passwd or http://www.example.com/static.jsp?content=../WEB-INF/web.xml

I'd suggest using a white list of the static content that this page is permitted to return.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .