IBM WebSphere V5.0 Security - CGISecurity

Note: The previously introduced logout only works together with form-basedlogin. When the application is configured to use Basic Authentication (BA), thecredentials are stored in the client’s browser and the browser will send theuser name and password to the server together with every request. The onlyway to log out is to break the session by closing the browser.4.6 Additional security guidelinesThis section provides some useful information and proivides food for thoughtabout security considerations and issues. We cover the following topics:► Security constraints for the Web module► Struts security► Page expirationSecurity constraints for the Web moduleThere are multiple approaches to setting authorization rules for resources. In thiscase, we will investigate the possibilities for Web resource protection using Websecurity constraints in the Web module.The first approach is to map resources to roles, and define what resources a rolecan access. If you design your Web security constraints to use one constraint forevery role and you have the same resource accessible by multiple roles, thesecurity will not work correctly because of bad design.According to the Java Servlet 2.3 specification, the exact or longest path matchis used to get the required roles for a given URL. Let us consider the followingsituation:► We have two roles defined for the application: A and B.► We have the following Web resources in the Web module:– /helloworld/helloEurope.html– /helloworld/helloAfrica.html► We have the following Web security constraints in the Web module:– Constraint ‘X’: role: ‘A’ can access the resource(s): /dir/*– Constraint ‘Y’: role: ‘B’ can access the resource(s): /dir/helloEurope.htmlChapter 4. Securing Web components 69