2
如果我第一次打開示例網址http://localhost:8080/examples/jsp/security/protected/index.jsp,我將會看到登錄表單,其中username
和password
字段。此表單的Html代碼位於login.jsp
文件中,但我看不到任何代碼可以從index.jsp
中調用它。這個通話如何完成?Tomcat7安全示例如何調用login.jsp?
如果我第一次打開示例網址http://localhost:8080/examples/jsp/security/protected/index.jsp,我將會看到登錄表單,其中username
和password
字段。此表單的Html代碼位於login.jsp
文件中,但我看不到任何代碼可以從index.jsp
中調用它。這個通話如何完成?Tomcat7安全示例如何調用login.jsp?
它在相應的web.xml
定義:
<!-- Default login configuration uses form-based authentication -->
<login-config>
<auth-method>FORM</auth-method>
<realm-name>Example Form-Based Authentication Area</realm-name>
<form-login-config>
<form-login-page>/jsp/security/protected/login.jsp</form-login-page>
<form-error-page>/jsp/security/protected/error.jsp</form-error-page>
</form-login-config>
</login-config>
你找到<tomcat>/webapps/examples/WEB-INF
文件。它利用內置的Java EE安全功能。前面的security-constraint
部分定義了要保護的資源:
<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<!-- Define the context-relative URL(s) to be protected -->
<url-pattern>/jsp/security/protected/*</url-pattern>
<!-- If you list http methods, only those methods are protected -->
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<!-- Anyone with one of the listed roles may access this area -->
<role-name>tomcat</role-name>
<role-name>role1</role-name>
</auth-constraint>
</security-constraint>