JSP redirection

[delphine.ziegler]

Hello,

I have a JSP page a.jsp. My server web is Apache and I use Tomcat.
Apache has a known break : it doesn't stop cross-site scripting. So in
my JSP, I check the URL to see if the "<" character is not present. If
it is present, I want to redirect the user to an error page (which can
be in another server). If it is present, I continue to execute my page
a.jsp. I use response.sendRedirect() but it doesnt't worf. Has anybody
got an idea ?

Thanks

Delphine

 

[anu]

you can use RequestDispatcher rd=request.getRequestDispatcher("url")
method
followed by rd.forward(request,response) also.i don't know whether it
works with two servers....i have used this only with a single
server.please try it

 

[delphine.ziegler]

Thanks...

I did what you said but I have the following error :

java.io.IOException: Stream closed
org.apache.jasper.runtime.JspWriterImpl.ensureOpen(JspWriterImpl.java:202)
org.apache.jasper.runtime.JspWriterImpl.clearBuffer(JspWriterImpl.java:157)
org.apache.jsp.content.appli_005fsol_005fiplanet.production.login_jsp._jspService(login_jsp.java:120)
org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:94)
javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:324)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:292)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:236)
javax.servlet.http.HttpServlet.service(HttpServlet.java:802)



Need to make a precision : my page a.jsp is included in another page
(login.jsp). Could it cause a problem ?

 

[Andrea Desole]

Hello,

I have a JSP page a.jsp. My server web is Apache and I use Tomcat.
Apache has a known break : it doesn't stop cross-site scripting. So in
my JSP, I check the URL to see if the "<" character is not present. If
it is present, I want to redirect the user to an error page (which can
be in another server). If it is present, I continue to execute my page
a.jsp. I use response.sendRedirect() but it doesnt't worf. Has anybody
got an idea ?

why doesn't it work? Do you have an error? An exception? What exactly
goes wrong?

 

[delphine.ziegler]

I don't have an error, I am not redirected, that's all...

When I called a.jsp my sendredirect works fine but when i called
login.jsp that includes a.jsp it doesn't work... Any idea ?

Delphine

 

[Alex Hunsley]

Hello,

I have a JSP page a.jsp. My server web is Apache and I use Tomcat.
Apache has a known break : it doesn't stop cross-site scripting. So in
my JSP, I check the URL to see if the "<" character is not present. If
it is present, I want to redirect the user to an error page (which can
be in another server). If it is present, I continue to execute my page
a.jsp. I use response.sendRedirect() but it doesnt't worf. Has anybody
got an idea ?

What exactly do you mean by "doesn't work"? What happens?
Stating versions of apache and tomcat wouldn't hurt either.

 

[delphine.ziegler]

it executes the rest of my code so login.jsp is displayed.

Apache : 2.0.47
Tomcat : 5.0.28

 

[Andrea Desole]

I don't have an error, I am not redirected, that's all...

When I called a.jsp my sendredirect works fine but when i called
login.jsp that includes a.jsp it doesn't work... Any idea ?

Apparently redirect doesn't work with includes. Check the documentation
of RequestDispatcher.include(). You can't change the response code or
the headers

 

[Andrea Desole]

Apparently redirect doesn't work with includes. Check the documentation
of RequestDispatcher.include(). You can't change the response code or
the headers

sorry, of course I missed to say that this is for dynamic includes. I
assume this is what you are using

 

[delphine.ziegler]

No, the include in login.jsp is done like this :

<jsp:include page="a.jsp" />

 

[Andrea Desole]

No, the include in login.jsp is done like this :

<jsp:include page="a.jsp" />

exactly.
Try <%@include file="a.jsp"%>

 

[delphine.ziegler]

Thanks with <%@include %> it works fine. But is there another solution
? I have several login.jsp that include my page a.jsp... could you
confirm me that with <jsp:include /> it doesn't work ?

Thanks a lot...

 

[Andrea Desole]

Thanks with <%@include %> it works fine. But is there another solution
? I have several login.jsp that include my page a.jsp... could you
confirm me that with <jsp:include /> it doesn't work ?

Yes, it doesn't work. As I said, check the documentation; it's
definitely more reliable than me

Another solution might be to forward, but:
1) I see you tried, with no success. The exception you get is fairly
strange, by the way, and it might be related to your code.
2) even if you solve the problem, I don't think you can forward to pages
outside of your context, so forwarding to another server is probably
unfeasible

I don't think there is another solution. Not without changing your login
pages