【转】web.xml文件分析

<?xml version="1.0" encoding="UTF-8"?>    <!-- web.xml文件的schema信息 -->                                                 
                                                                                                                           
<!-- 其他的元素都被放到了web-app标签之中 -->                                                                               
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"                                                                           
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"                                                                    
  version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee                                                        
  http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">                                                                        
                                                                                                                           
  <description>                         <!-- description标签是对站点的描述 -->                                                             
  </description>                                                                                                           
                                                                                                                           
  <display-name>                     <!-- display-name标签定义站点的名称 -->                                                            
  </display-name>                                                                                                          
                                                                                                                           
  <distributable>                      <!-- distributable标签,该站点是否支持分布式管理 -->                                                
  </distributable>                                                                                                         
                                                                                                                           
  <content-param>                   <!-- 用来设定web站台的环境参数-->                                                                  
    <param-name>                    <!-- 参数的名字  -->                                                                               
        MyName                                                                                                               
    </param-name>                                                                                                          
    <param-value>                     <!-- 参数的值 -->                                                                                  
        SuperMos                                                                                                             
    </param-value>                                                                                                         
  </content-param>                  <!-- getServletContent().getInitParameter("MyName"); -->                                           
                                                                                                                           
                                                                                                                           
  <filter>                                   <!-- 用来声明filter的相关的设定 -->                                                                
    <filter-name>                       <!-- 这里保存的当然就是filter的名字 -->                                                            
        SetCharacterEncoding                                                                                                 
    </filter-name>                                                                                                         
                                                                                                                           
    <filter-class>                        <!-- 这里来定义的就是filter类 -->                                                                  
        com.yinhai.SetCharacterEncodingFilter                                                                                
    </filter-clss>                                                                                                         
                                                                                                                           
    <init-param>                        <!-- 这里来定义参数 -->                                                                            
      <param-name>                  <!-- 这里来指定参数的名称 -->                                                                      
          encoding                                                                                                           
      </param-name>                                                                                                        
      <param-value>                   <!-- 这里来制定参数的值 -->                                                                        
          utf-8                                                                                                              
      </param-value>                                                                                                       
    </init-param>                                                                                                          
  </filter>                                  <!-- filter必须和filter-mapping配合使用 -->                                                        
                                                                                                                           
  <filter-mapping>                    <!-- 指定filter所对应的URL -->                                                                     
      <filter-name>                     <!-- 这里来指定filter的名字 -->                                                                    
            SetCharacterEncoding                                                                                             
      </filter-name>                                                                                                       
      <url-pattern>                     <!-- 这里来指定filter所作用的URL -->                                                               
            /*                                                                                                               
      </url-pattern>                                                                                                       
  </filter-mapping>                                                                                                        
                                                                                                                           
  <servlet>                              <!-- 用来声明一个servlet数据 -->                                                                   
    <servlet-name>                                                                                                         
          SuperMos                                                                                                           
    </servlet-name>                                                                                                        
    <servlet-class>                                                                                                        
          com.yinhai.SuperMosServlet                                                                                         
    </servlet-class>                                                                                                       
    <jsp-file>                           <!-- 指定web站台中的某个jsp页面的完整的路径 -->                                                     
                                                                                                                           
    </jsp-file>                                                                                                            
    <init-param>                      <!-- 用来定义参数使用的,里面有name和value -->                                                       
                                                                                                                           
    </init-param>                                                                                                          
  </serlet>                                                                                                                
                                                                                                                           
  <servlet-mapping>                <!-- 和servlet配合使用的标签用来定义url -->                                                         
    <servlet-name>                                                                                                         
        SuperMos                                                                                                             
    </servlet-name>                                                                                                        
    <url-pattern>                                                                                                          
        /yinhai/SuperMosquito                                                                                                
    </url-pattern>                                                                                                         
  </servlet-mapping>                                                                                                       
                                                                                                                           
  <session-config>                     <!-- 用来定义web站点的session参数 -->                                                               
    <session-timeout>                <!-- 用来定义该站点的session有效期,时间为分钟 -->                                                   
        30                                                                                                                   
    </session-timeout>                                                                                                     
  </session-config>                                                                                                        
                                                                                                                           
  <mime-mapping>                    <!-- 定义一个扩展名和某一个MIME type做对应 -->                                                      
    <extension>                          <!-- 扩展名的名称 -->                                                                               
        xls                                                                                                                  
    </extension>                                                                                                           
    <mime-type>                        <!-- 对应的MIME的格式 -->                                                                           
         application/vnd.ms-excel                                                                                             
    </mime-type>                                                                                                           
  </mime-mapping>                                                                                                          
                                                                                                                           
  <welcome-file-list>                 <!-- 用来定义首页的列单 -->                                                                         
    <welcome-file>                    <!-- 定义首页的文件名称 -->                                                                         
          index.jsp                                                                                                          
    </welcome-file>                                                                                                        
    <welcome-file>                                                                                                         
          index.html                                                                                                         
    </welcome-file>                                                                                                        
  </welcome-file-list>                                                                                                     
                                                                                                                           
  <error-page>                        <!-- 用来处理错误的代码或者是异常的页面 -->                                                         
    <error-code>                      <!-- 指定错误的代码  -->                                                                            
        404                                                                                                                  
    </error-code>                                                                                                          
    <location>                           <!-- 指定在web站点内的相应的资源的路径 -->                                                          
         /error404.jsp                                                                                                       
    </location>                                                                                                            
  </error-page>                                                                                                            
  <error-page>                        <!-- 用来处理错误的代码或者是异常的页面 -->                                                         
    <error-code>                      <!-- 指定错误的异常信息  -->                                                                        
          java.lang.Exception                                                                                                
    </error-code>                                                                                                          
    <location>                           <!-- 指定在web站点内的相应的资源的路径 -->                                                          
         /exception.jsp                                                                                                    
    </location>                                                                                                            
  </error-page>                                                                                                            
                                                                                                                           
  <taglib>                               <!-- 用来指定jsp页面用到的tag Library路径  -->                                                      
    <taglib-uri>                        <!-- 指定TLD文件的uri,在jsp页面中用taglib指令取出 -->                                               
        TagLib                                                                                                             
    </taglib-uri>                                                                                                          
    <taglib-location>                <!-- 指定TLD文件的存放位置  -->                                                                     
        /WEB-INF/tlds/TagLib.tld                                                                                           
    </taglib-location>                                                                                                     
  </taglib>                                                                                                                
                                                                                                                           
  <resource-ref>                      <!-- 利用jndi可以取得可用资源,比如数据源 -->                                                         
    <description>                      <!-- 资源的说明 -->                                                                                  
        JNDI JDBC DataSource of SuperMos                                                                                   
    </description>                                                                                                         
    <res-ref-name>                 <!-- 资源的名称 -->                                                                                  
        jdbc/SuperMos_db                                                                                                   
    </res-ref-name>                                                                                                        
    <res-type>                        <!-- 资源的种类 -->                                                                                  
        javax.sql.DataSource                                                                                               
    </res-type>                                                                                                            
    <res-auth>                        <!-- 资源的许可,由Container或者Application -->                                                       
        Container                                                                                                          
    </res-auth>                                                                                                            
    <res-sharing-scope>          <!-- 资源是否可以共享Shareable,Unshareable -->                                                     
        Shareable                                                                                                          
    </res-sharing-scope>                                                                                                   
  </resource-ref>                                                                                                          
                                                                                                                           
</web-app>                                                                                                                

 

 

<jsp-config> 包括<taglib> 和<jsp-property-group> 两个子元素。   
    其中<taglib>元素在JSP 1.2时就已经存在；而<jsp-property-group>是JSP 2.0 新增的元素。
    <jsp-property-group>元素主要有八个子元素，它们分别为：   
    1.<description>：设定的说明；
    2.<display-name>：设定名称；
    3.<url-pattern>：设定值所影响的范围，如：/CH2 或 /*.jsp；
    4.<el-ignored>：若为true，表示不支持EL 语法；
    5.<scripting-invalid>：若为true，表示不支持<% scripting %>语法；
    6.<page-encoding>：设定JSP 网页的编码；
    7.<include-prelude>：设置JSP 网页的抬头，扩展名为.jspf；
    8.<include-coda>：设置JSP 网页的结尾，扩展名为.jspf。

 

一个简单的<jsp-config>元素完整配置：

<jsp-config>
    <taglib>
        <taglib-uri>Taglib</taglib-uri>
        <taglib-location>/WEB-INF/tlds/MyTaglib.tld</taglib-location>
    </taglib>
    <jsp-property-group>
        <description>Special property group for JSP Configuration JSP example.</description>
        <display-name>JSPConfiguration</display-name>
        <url-pattern>/jsp/* </url-pattern>
        <el-ignored>true</el-ignored>
        <page-encoding>GB2312</page-encoding>
        <scripting-invalid>true</scripting-invalid>
        <include-prelude>/include/prelude.jspf</include-prelude>
        <include-coda>/include/coda.jspf</include-coda>
    </jsp-property-group>
</jsp-config>

配置web.xml来限制对某些servlet的请求

 

 

     有时我们只希望通过认证的用户才能请求某些servlet的话，就可以在web.xml中来进行相应的配置，来达到此目的。

这就要用到<security-constraint></security-constraint>元素。
对于tomcat，中web.xml使用security-constraint元素需要在位于<Tomcat-installation-directory>/conf/tomcat-users.xml的XML文件中创建用户名和密码。比如下面的这个tomcat-users.xml文件：

 

 

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
<role rolename="tomcat"/>
<role rolename="manager"/>
<role rolename="admin"/>
<user username="tomcat" password="tomcat" roles="tomcat"/>
<user username="both" password="tomcat" roles="tomcat,manager"/>
<user username="admin" password="admin" roles="admin"/>
</tomcat-users>

 

此XML片段包括一个tomcat-users根元素，它包含一个或多个role和user元素。
然后在Web应用程序的web.xml中创建security-constraint、login-config和security-role元素。

 

<security-constraint>
      <web-resource-collection>
          <web-resource-name>HelloServlet</web-resource-name>
          <url-pattern>/HelloServlet</url-pattern>
          <http-method>GET</http-method>
          <http-method>POST</http-method>
      </web-resource-collection>

      <auth-constraint>
          <description>This applies only to the "tomcat" security role</description>
          <role-name>admin</role-name>
      </auth-constraint>

      <user-data-constraint>
          <transport-guarantee>NONE</transport-guarantee>
      </user-data-constraint>
</security-constraint>

 

<login-config>
      <auth-method>BASIC</auth-method>
</login-config>

<security-role>
      <role-name>admin</role-name>
</security-role>

 

      其中security-constraint元素包含一个或多个web-resource-collection元素，它是描述Web应用程序中的哪些web资源受到指定安全限制的保护。http-method元素指定安全限制覆盖的HTTP方法。上面的例子中，当我们对/HelloServlet的GET或POST请求时将触发配置的安全机制。
    auth-constraint元素用于描述允许访问Web组件的安全角色。此例中安全角色的例子有tomcat、manager、admin。而只有当作为admin角色的用户才可以访问HelloServlet。

 

    Web应用程序通过login-config元素来认证用户，并确认该用户是否为正确的角色。
     longin-config包含的transport-guarantee子元素用来指定认证方法，BASIC是一种常见的Web认证方式，浏览器给用户提示一个对话框，要求输入用户名和密码，随后Tomcat将给出的用户名和密码与tomcat-users.xml中的用户名和密码进行比较，然后使用前面的security-constraint配置来确定用户是否可访问受保护的servlet。

 

（除BASIC外，还可以是FORM、CLIENT-CERT、DIGEST等）

 

其实这种认证方法实际上有两个步骤：
1、检查提供的用户名和密码是否正确。
2、判断用户是否映射到特定的安全角色。例如，用户可能提供了正确的用户名和密码，但没有映射到特定的安全角色，也将被禁止访问特定的Web资源