If only deny is used, then all ip's are allowed if they do not match a deny. If only allow is used, then an ip is denied unless it matches an allow. If both are used, then the ip must match both an allow and a deny

Any custom security constraint is checked after any authentication (login) but before any filters or servlets are applied. The security constraint will return true if the request is allowed and false if it's forbidden. If the request is forbidden, it's the constraint's responsibility to use response.sendError() or to return an error page.

package example; import java.io.*; import javax.servlet.*; import javax.servlet.http.*; import com.caucho.server.security.*; public class CustomSecurity extends AbstractConstraint { private String foo = "false"; public void setFoo(String foo) { this.foo = foo; } public boolean needsAuthentication() return false; } public boolean isAuthorized(HttpServletRequest request, HttpServletResponse response, ServletContext application) throws ServletException, IOException { if (foo.equals(request.getParameter("test"))) return true; response.sendError(response.SC_FORBIDDEN); return false; } }

The needsAuthentication method tells Resin that it needs to log in the user before checking the authorization. This would allow the custom authorizer to check user roles or the user principle for the proper permissions.

<constraint resin:type="example.CustomSecurity"> <foo>test-value</foo> </constraint>

Sometimes it is necessary to protect files from being viewed by anyone, such as configuration files used in your code but not meant to be served to a browser.

Place files in WEB-INF or a subdirectory of WEB-INF. Any files in WEB-INF or it's subdirectories will automatically be protected from viewing.

Use a security constraint that requires a role that nobody will ever have.

<web-app> ...  <security-constraint> <web-resource-collection> <url-pattern>*.properties</url-pattern> </web-resource-collection> <auth-constraint role-name='nobody'/> </security-constraint>  <security-constraint> <web-resource-collection> <url-pattern>/config/*</url-pattern> </web-resource-collection> <auth-constraint role-name='nobody'/> </security-constraint> ... </web-app>

Use a simple servlet that returns a 403 error, which means "Forbidden". Resin provides the servlet which is useful for this:

<web-app> ... <servlet> <servlet-name>forbidden</servlet-name> <servlet-class>com.caucho.servlets.ErrorStatusServlet</servlet-class> <init> <status-code>403</status-code> </init> </servlet> <servlet-mapping url-pattern="*.properties" servlet-name="forbidden"/> <servlet-mapping url-pattern="/config/*" servlet-name="forbidden"/> ... </web-app>

Or you could implement your own servlet:

package example.servlets; import javax.servlet.*; import javax.servlet.http.*; import java.io.IOException; /** * Respond with a 403 error */ public class Forbidden extends GenericServlet { public void service(ServletRequest request, ServletResponse response) throws ServletException, IOException { HttpServletResponse res = (HttpServletResponse) response; res.sendError(403); } }