Member Avatar for maydhyam

Hi,

I have a web application where the users have to create an account to be able to access the entry form. I have 2 types of users, 1. Admin and 2. User. I have a Java application that is called via a link on the page, but I only want the link to work for the Admin users...

Is this possible? and if so, can you please guide me

Thanks in advance...

  • 3 Contributors
  • 5 Replies
  • 114 Views
  • 7 Months Discussion Span
  • Latest Post Latest Post by maydhyam

Dani AI

Generated

Short answer: yes — but user-interface hiding is only UX. As and pointed out, showing the link only for admins improves the UI, and storing the role at login is a good start. The critical part is enforcing authorization on the server side for the endpoint the link calls. Any user who knows or guesses the URL must be rejected unless the server verifies their role on every request.

Practical checklist to secure the link and the called Java app:

  • Keep authoritative role data on the server (database) and associate it with the user session or token.
  • Protect the endpoint itself with a per-request check (middleware/filter) so the link target cannot be used without the admin role.
  • Return the correct HTTP status (403 Forbidden) for unauthorized requests and log those attempts for audit.
  • Use HTTPS, secure HttpOnly cookies, and short-lived/signed tokens if you need one-time links or downloads.
  • Avoid performing sensitive operations via GET; require POST + CSRF protection for state changes.
  • Consider container-managed security, servlet filters, or a framework (Spring Security, modern PHP frameworks) rather than ad-hoc checks scattered through pages.

Example (Java servlet filter) to show server-side enforcement:

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.IOException;

public class AdminFilter implements Filter {
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
      throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    HttpSession session = request.getSession(false);
    Object role = (session != null) ? session.getAttribute("role") : null;
    if ("ADMIN".equals(role)) {
      chain.doFilter(req, res);
    } else {
      response.sendError(HttpServletResponse.SC_FORBIDDEN);
    }
  }
  public void init(FilterConfig fc) {}
  public void destroy() {}
}

If the Java app is launched outside the browser (Web Start, download), gate the download with the same authorization checks and prefer signed, time-limited URLs. For detailed access-control guidance, see the OWASP Access Control Cheat Sheet and the HTTP 403 semantics on MDN: OWASP Access Control Cheat Sheet — MDN: 403 Forbidden.

Recommended Answers

All 5 Replies

Member Avatar for nav33n

Display the link only if the user is admin. Don't display the link for normal users.

Member Avatar for carobee

you can set session variables when the user login as admin .check if the session variable is set, if so then display the link or else don't

Member Avatar for maydhyam

Display the link only if the user is admin. Don't display the link for normal users.

In this, you said 'display the link'.....what do you mean?

Member Avatar for nav33n

Example,

<?php
session_start();
if($_SESSION['user'] == "admin") {
 echo "<a href=link.php?user=$username&hash=some_hash_to_check_a_valid_user> Click here </a>";
} 
?>

If the user is admin, then it will show the above link. Also, in link.php, have a security check to cross check if the user is really an admin!

Member Avatar for maydhyam

Hi Nav33n,

I followed your advice and I got it to work. Thanks alot...
:)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.