Security

[Renu Radhika]

Which statements are correct about security?

1) The security model doesn't apply when a servlet uses a RequestDispathcer to include or forward a resource
2) The security model doesn't apply when a servlet uses a RequestDispathcer to include a resource but it applies when it uses forward
3) The security model applies when a servlet uses a RequestDispathcer to include or forward a resource
4) The security model doesn't apply when a servlet uses a RequestDispathcer to include or include a static resource


The correct answwer given is

1) The security model doesn't apply when a servlet uses a RequestDispathcer to include or forward a resource

What about 4.I feel that is also correct

[Ulf Dittmer]

Please QuoteYourSources.

[Renu Radhika]

The source is

http://www.javaranch.com/carl/SCWCD.htm

[Renu Radhika]

Do anyone has any hint?

[Joe San]

Any reasons as to why the security model does not apply when we use RequestDispatcher to forward or include a resource?

[Christophe Verré]

The security model applies to the static content part of the web application and to servlets and filters within the application that are requested by the client. The security model does not apply when a servlet uses the RequestDispatcher to invoke a static resource or servlet using a forward or an include.

[Joe San]

Satou, is this a fact that we need to accept or is there any logical reason behind it?

[Renu Radhika]

Santou,
So it means 1 and 4 are correct right?

Jothi,
The security constraints are defined in web.xml and its meant for client requests and not for internal request from request dispatcher.Just as files within web-inf are not directly accessible to clients but we can access it from within other classes in the web app.

[Christophe Verré]

I'd say 1 and 4.