blocks|key|1000961|text|当有人访问该链接所指向的URL时，检查他们是否已通过身份验证(如果没有，则向他们显示登录页面)，以及他们通过身份验证的用户是否有权访问该页面(如果没有，则向他们显示一条错误消息，解释这一点，并给他们一个“以不同用户身份登录”表单)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1000962|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

When someone visits the URL the link points to, check if they have been authenticated (if not, show them a login page) and if the user they are authenticated as is authorised to access the page (if not, show them an error message explaining that and give them a "log in as a different user" form).

blocks|key|4460169|text|Quentin建议应该可以做到，如果你正在开发一个演示应用程序，这可能就足够了。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4460170|但是，如果您真的想实现健壮的身份验证和授权，那么在学习任何开源安全框架时都应该认真考虑一下。|4460171|这可以避免很多令人头疼的问题，特别是如果你为你的应用定制了一个安全机制。|4460172|reference+guide|offset|length|4460173|shiro+apache|unordered-list-item|4460174|
|4460175|Spring+Security|4460176|
+|4460177|JAAS+tutorials|4460178|4460179|entityMap|0|LINK|mutability|MUTABLE|url|http://java.sun.com/javase/6/docs/technotes/guides/security/jaas/JAASRefGuide.html|1|http://shiro.apache.org/|2|http://static.springsource.org/spring-security/site/docs/3.0.x/reference/springsecurity-single.html#what-is-acegi-security|3|http://java.sun.com/javase/6/docs/technotes/guides/security/jaas/tutorials/index.html^0|0|0|0|0|F|0|0|0|C|1|0|0|0|F|2|0|0|5|9|3|0|0^^$0|@$1|2|3|4|5|6|7|19|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1A|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1B|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|1C|8|@]|9|@$H|1D|I|1E|1|1F]]|A|$]]|$1|J|3|K|5|L|7|1G|8|@]|9|@$H|1H|I|1I|1|1J]]|A|$]]|$1|M|3|N|5|6|7|1K|8|@]|9|@]|A|$]]|$1|O|3|P|5|L|7|1L|8|@]|9|@$H|1M|I|1N|1|1O]]|A|$]]|$1|Q|3|R|5|6|7|1P|8|@]|9|@]|A|$]]|$1|S|3|T|5|L|7|1Q|8|@]|9|@$H|1R|I|1S|1|1T]]|A|$]]|$1|U|3|-4|5|6|7|1U|8|@]|9|@]|A|$]]|$1|V|3|-4|5|6|7|1V|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]|13|$5|Y|Z|10|A|$11|14]]|15|$5|Y|Z|10|A|$11|16]]|17|$5|Y|Z|10|A|$11|18]]]]

Quentin suggestion should do , and its probably enough if you are developing a demo app,

But if you serious on implementing an robust authentication and authorization , then you should seriously give a thought in learning any open source security framework.

This could save from lots of headaches especially if your custom building a security for your app. 

<ul>
<li>JAAS <a href="http://java.sun.com/javase/6/docs/technotes/guides/security/jaas/tutorials/index.html" rel="nofollow">tutorials</a> | <a href="http://java.sun.com/javase/6/docs/technotes/guides/security/jaas/JAASRefGuide.html" rel="nofollow">reference guide</a></li>
<li><a href="http://shiro.apache.org/" rel="nofollow">shiro apache</a></li>
<li><a href="http://static.springsource.org/spring-security/site/docs/3.0.x/reference/springsecurity-single.html#what-is-acegi-security" rel="nofollow">Spring Security</a></li>
</ul>

blocks|key|1001250|text|首先，根据Sudhakar的建议，选择一个吸引您的安全框架，比如Apache+Shiro或Spring+Security。为了理解不同的安全框架，你可能会喜欢Matt+Raible在这里对2011的概述：Spring+Security和Apache+Shiro，以及其他。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1001251|接下来，如果您选择了安全框架，您应该能够非常简单地遵循Quentin的答案。|1001252|最基本的方案是基于角色将页面划分为逻辑组(您应该有几个角色)：例如，路径为/admin/users/edit+(和admin/...)的页面将针对具有管理员角色的人员，/user/order/view+(和user/...)将对注册用户可见，等等。如果您希望为特定用户角色呈现页面的某些部分，则需要更高级的设置，例如两个管理员都将访问/user/edit，但只有当当前用户的角色等于管理员时，才会呈现按钮delete。为了更好地保护应用程序，您选择的框架应该提供一种基于用户角色保护业务逻辑方法的方法。如果你选择Shiro，也可能有一些特殊的标签来简化视图的创建，比如<shiro:hasRole>。|style|CODE|1001253|但是，对于您的情况，基本的解决方案是使用支持bean方法public+boolean+isRoleOne()+{+return+role.equals("1");+}的<h:link+rendered="#{currentUser.roleOne}"/>。当然，它只会隐藏链接，但用户仍然可以通过其url访问页面。因此，您最终要么编写筛选器的样板代码，要么使用公认的安全框架提出的解决方案。|1001254|entityMap|0|LINK|mutability|MUTABLE|url|http://raibledesigns.com/rd/entry/java_web_application_security_part1|1|http://raibledesigns.com/rd/entry/java_web_application_security_part2^0|2U|F|0|3A|C|1|0|0|11|H|1L|9|2C|G|2V|8|4N|A|7W|F|0|S|1J|2C|17|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]|$A|Z|B|10|1|11]]|C|$]]|$1|D|3|E|5|6|7|12|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|13|8|@$A|14|B|15|H|I]|$A|16|B|17|H|I]|$A|18|B|19|H|I]|$A|1A|B|1B|H|I]|$A|1C|B|1D|H|I]|$A|1E|B|1F|H|I]]|9|@]|C|$]]|$1|J|3|K|5|6|7|1G|8|@$A|1H|B|1I|H|I]|$A|1J|B|1K|H|I]]|9|@]|C|$]]|$1|L|3|-4|5|6|7|1L|8|@]|9|@]|C|$]]]|M|$N|$5|O|P|Q|C|$R|S]]|T|$5|O|P|Q|C|$R|U]]]]

First of all, choose a security framework that appeals to you, like Apache Shiro or Spring Security, as proposed by Sudhakar. To get an understanding of different security frameworks you may like Matt Raible's overview of 2011 here: <a href="http://raibledesigns.com/rd/entry/java_web_application_security_part1" rel="nofollow">Spring Security</a> and <a href="http://raibledesigns.com/rd/entry/java_web_application_security_part2" rel="nofollow">Apache Shiro</a>, among others.

Next, you should be able follow Quentin's answer quite simply, if you chose the security framework.

The very basic scheme is dividing the pages into logical groups based on roles (which you shiuld have a few): for instance, pages with paths <code>/admin/users/edit</code> (and <code>admin/...</code>) would be aimed at people with role of administrator, <code>/user/order/view</code> (and <code>user/...</code>) would be visible to registered users, etc. The more advanced setting will be necessary in case you want to have sections of a page rendered for particular user roles, like both admins will have access to <code>/user/edit</code>, but the button delete will be rendered only if current user's role equals administrator. To secure the application more, the framework you choose should provide for a way of securing business logic methods basing on user roles. There might also be some special tags to ease view creation, like <code>&lt;shiro:hasRole&gt;</code>, if you choose Shiro.

But the basic solution to your situation is <code>&lt;h:link rendered="#{currentUser.roleOne}"/&gt;</code> with backing-bean method <code>public boolean isRoleOne() { return role.equals("1"); }</code>. Of course, it will only hide the link, but the user will still be able to access the page via its url. So, you will eventually end up either writing much of a boilerplate code of a Filter or using a solution proposed by a well-accepted security framework.

I am hiding some links in my webapp depending on the user roles...Now for example I hide the link sample.jsp in my user with role equal to 1. Ofcourse this will hide but if this user knows the link he can eventually go to that link...How to configure this?

How to secure links in your JSP web application?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我在我的but应用程序中隐藏了一些链接，这取决于用户roles...Now。例如，我在角色等于1的用户中隐藏了链接sample.jsp。当然，这会隐藏，但如果这个用户知道链接，他最终可以转到该link...How进行配置吗？

问如何保护JSP web应用程序中的链接？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何保护JSP web应用程序中的链接？EN