Member Avatar for vaitalaziz

Hi ...

I'm doing 1 web-system, where login page in .jsp but other functional page in .html where I use javascript to do function. So if user knows any other html page's url then they can browse directly any of those page. But I've to prevent them & send to login page if they try to browse with out login. Very sad I can't do it :icon_mad:

Please any1 help me to get this solution.

Really it's very urgent :sad:

Thanks in advance

  • 3 Contributors
  • 2 Replies
  • 324 Views
  • 16 Hours Discussion Span
  • Latest Post Latest Post by Taywin

Dani AI

Generated

Good instincts from and — protect pages on the server and use the HttpSession created at login. A practical, safe pattern is: put pages that require authentication under a protected path (for example /secure/), add a servlet Filter that checks for a session attribute set at successful login, and redirect to login.jsp if the attribute is missing. This avoids brittle client-side checks and prevents direct URL access.

Example Filter (Servlet 3+ annotation) — map it to the folder that holds your protected HTML files (here /secure/*):

import java.io.IOException;
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.*;

@WebFilter("/secure/*")
public class AuthFilter implements Filter {
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest  request  = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        HttpSession session = request.getSession(false);
        boolean loggedIn = session != null && session.getAttribute("user") != null;
        if (loggedIn) {
            chain.doFilter(req, res);
            return;
        }
        String original = request.getRequestURI() +
          (request.getQueryString() != null ? "?" + request.getQueryString() : "");
        request.getSession(true).setAttribute("origUrl", original);
        response.sendRedirect(request.getContextPath() + "/login.jsp");
    }
}

If you use web.xml mapping instead of annotations, map the filter to /secure/*. After authenticating in your login servlet/JSP, set session.setAttribute("user", username) and then redirect back to the saved origUrl (or a default page) so users land where they tried to go.

Troubleshooting/cautions: keep login.jsp outside the protected path to avoid redirect loops; do not map the filter to /* unless you explicitly allow static resources (CSS/JS/images) and the login page; consider moving truly static files under WEB-INF and serve them via an authenticated servlet if you must keep them as HTML; and always use HTTPS and regenerate the session after login for security. This approach is simple, server-side, and works whether or not JavaScript is enabled.

Recommended Answers

All 2 Replies

Member Avatar for Stefan_Lam88

use session

Member Avatar for Taywin

Actually, you should do the check on the server side. The reason is that JavaScript can be disabled and that would allow users to go directly to the page anyway. What you need to do is checking for log-in before you render the page. If the user has not logged in yet, send the user to another page from there.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.