Exclude css and image resources in web.xml Security Limit

Question

I am using JSF2.1 and Glassfish 3.1.2.

I specify a security restriction to block everything:

<security-constraint> <web-resource-collection> <web-resource-name>Secured Content</web-resource-name> <!-- Block all --> <url-pattern>/*</url-pattern> </web-resource-collection> <!-- only users with at least one of these roles are allowed to access the secured content --> <auth-constraint> <role-name>ADMINISTRATOR</role-name> </auth-constraint> </security-constraint> 

and have different access to a subset of pages and resources:

 <security-constraint> <web-resource-collection> <web-resource-name>Open Content</web-resource-name> <!-- Allow subscribe --> <url-pattern>/subscribe/*</url-pattern> <url-pattern>/javax.faces.resource/*</url-pattern> </web-resource-collection> <!-- No Auth Contraint! --> </security-constraint> 

It works great. However, there is the following

 <url-pattern>/javax.faces.resource/*</url-pattern> 

the correct way to resolve all resources?

I just did this by looking at the URL that Facelets injects into xhtml. Are there security holes with this approach?

Thanks.

Answer 1

This value is ResourceHandler#RESOURCE_IDENTIFIER constant. See also javadoc :

RESOURCE_IDENTIFIER

public static final java.lang.String RESOURCE_IDENTIFIER

Resource#getRequestPath returns the value of this constant as a URI prefix. handleResourceRequest(javax.faces.context.FacesContext) searches the value of this constant in the request URI to determine if the request is a resource request or a view request.

See also:

Constant Field Values

The constant field values say the following:

 public static final java.lang.String RESOURCE_IDENTIFIER "/javax.faces.resource" 

So, you are absolutely right about the URL pattern. There are no security holes, provided that you do not put sensitive information in the /resources folder of the public webcontent, which is processed by the JSF resource handler.