Start

In web applications, it is common to control whether or not screen operations are possible based on login status and user privileges. In the case of an internal web application, the users are all good people, so you don't have to worry too much about the strictness of the controls, but if it is for external use or the Internet, you should be careful. The risk of minor hacking always exists on the Internet, such as directly typing a URL into a web screen without permission, or calling an unauthorized event directly with a developer tool.

efw uses a property setting method to prevent the above risks. I would like to introduce this article to you.。

Skeleton Sample

The skeleton sample consists of a login screen, menu screen, and master management screen. I would like to control whether or not the master management screen can be operated based on the privileges of the logged-in user.

Screen Image

Folder Structure

Lists the elements involved in privilege control. Images and CSS that do not require restrictions are excluded.

skeletonSample
│  error.jsp　　　　　　　　　エラー画面
│  head.jsp　　　　　　　　　 ヘッダ部品
│  headbeforelogining.jsp　　ヘッダ部品（ログイン前画面向け）
│  headwithoutmenu.jsp　　　 ヘッダ部品（メニューリンク無し画面向け）
│  LG01.jsp　　　　　　　　　 ログイン画面
│  LG02.jsp　　　　　　　　　 メニュー画面
│  LG03.jsp　　　　　　　　　 パスワード忘れ画面
│  LG04.jsp　　　　　　　　　 パスワード変更画面
│  MST01.jsp　　　　　　　　  ユーザマスタ画面
│  MST01_inputdialog.jsp　　 ユーザ登録サブ画面（部品取り扱い）
│  MST01_uploaddialog.jsp　　アップロードサブ画面（部品取り扱い）
│  paging.jsp　　　　　　　　 ページング部品
│  
└─WEB-INF
    │  
    ├─classes
    │      efw.properties
    │      
    └─efw
        └─event
                global.js
                head_logout.js　　ログアウトイベント
                LG01_clear.js
                LG01_cookie.js
                LG01_submit.js
                LG02_goto.js
                LG03_chgPwd.js
                LG03_init.js
                LG04_sndPwd.js
                MST01_add.js
                MST01_clear.js
                MST01_delete.js
                MST01_download.js
                MST01_edit.js
                MST01_init.js
                MST01_inputdialog_init.js
                MST01_inputdialog_save.js
                MST01_search.js
                MST01_upload.js
                MST01_uploaddialog_save.js

Login Control

Goal Description

Login check is not required for the following pages and related events. In other words, you can operate it even if you are not logged in.
・Login page
・Forgot password page
・Password change page
・Error page
The following pages and related events require login check. In other words, if you operate it while not logged in, an error will occur.
・Menu page
・User master page
I don't want parts or sub-pages to be called independently.
The logout event must be able to be called even when the user is not logged in.
For example, if you leave the menu screen open for a long time, it will time out. If you try to log out in this state and receive a "please log in" alert, it will feel strange.

Property Settings

Configure the efw.properties file as follows to meet the above request.

efw.login.check = true
efw.login.key = USER_ID
efw.login.url = LG01.jsp
efw.outoflogin.url.pattern =[/](LG01|LG03|LG04).jsp
efw.outoflogin.eventid.pattern = LG01|LG03|LG04|head_logout

Translate the meaning of settings.
・Enable login control.
・The session item used for login control is USER_ID.
・The login screen is LG01.jsp.
・Screens that do not require login control are LG01.jsp, LG03.jsp, and LG04.jsp.
・Events containing the characters LG01, LG03, LG04, and head_logout do not require login control.

In the case of parts and sub-pages, they do not include the efw:client tag, so even if you forcefully call them from the browser, the event will not be executed, so there is no need to include them in the settings.

Operation Explanation

With the above settings, when you are not logged in (timed out) and operate a menu screen that is subject to login check, you will automatically be redirected to the login screen.

If an event subject to login check is executed in a non-login state (timeout state), the following error will be issued and the event will automatically transition to the login screen.
デベロッパーツールで軽いハッキングも同じくチェックされます。
以下のエビデンスは、未ログイン状態でログイン画面からユーザマスタ画面のイベントを呼び出すお試しです。イベント引数は基本的に画面とバインドしているから呼び出したらエラーが発生しますが、カスタマイズ引数の悪用でまたは引数なしの場合は呼び出せます。このとき、ログインチェック機能がガードしてくれます。

Authority Control

Goal Description

Login users are further divided into two types: administrators and general users.

Administrator
All screens and related events can be accessed.
General user
User master screen and related events cannot be accessed.

Property Settings

efw.auth.check = true
efw.auth.key = USER_ID
efw.system.error.url = error.jsp
efw.auth.cases = admin,user
admin.auth.pattern = ^admin.*$
admin.url.pattern = [/](LG02|MST01).jsp
admin.eventid.pattern = LG02|MST01
user.auth.pattern = ^((?!admin).)*$
user.url.pattern = [/](LG02).jsp
user.eventid.pattern = LG02

Translate the meaning of settings.
・Enable privilege control.
・The session item used for authority control is USER_ID.
・When a privilege control error occurs, the transition will be made to error.jsp on the system screen.
・There are two types of roles: administrator and general user.
・If the USER_ID is "admin##", it corresponds to the administrator role.
・Administrators can access the LG02.jsp and MST01.jsp screens.
・Administrators can access events containing the characters LG02 and MST01.
・If the USER_ID is not "admin##", it corresponds to a general user.
・General users can access the LG02.jsp screen.
・General users can access events containing the characters LG02.
It would be best to make the "User Management" button on the menu screen invisible to general users, but you will need a program to determine the role and control whether the button can be displayed. Please do this in the program on the menu screen, not in the property file settings.

LG01.jsp, LG03.jsp, LG04.jsp, error.jsp and related events do not require login and are not subject to permission control. In other words, it is a screen that anyone can see.

Operation Explanation

If general users try to connect a URL that is prohibited from viewing in the URL field, they will be redirected to a system error screen. And it doesn't explain why. *No need to be kind to hackers.

When executing a prohibited event from the developer tools, an unexpected error message will be displayed. When you close the error message, you will be redirected to the system error page.

For the system, it is common for a button to become inactive if it is prohibited to operate. In other words, normal operations should prevent you from going to prohibited screens and events. And permission control errors are only the reason for hacking. It is correct to give a system error.

Environment

The skeleton sample uses DB, email, and POI.
Please read the previous article for information related to environment construction.

The skeletonSample.backup file located directly under the sample folder is a postgres backup file. You can use it by restoring it. If you want to use another database, please create the table by referring to the SQL below.

CREATE TABLE "ユーザマスタ"
(
  "ユーザID" character varying(10) NOT NULL, -- ユーザID
  "パスワード" character varying(10), -- パスワード
  "ユーザ名" character varying(20), -- ユーザ名
  "メール" character varying(50), -- メール
  "コメント" character varying(200), -- コメント
  "初期化フラグ" integer, -- 初期化フラグ	 1：初期パスワードの場合　...
  "ロックフラグ" integer, -- ロックフラグ
  "パスワード更新日" date, -- パスワード更新日
  "作成日時" date, -- 作成日時
  "作成者" character varying(10), -- 作成者
  "更新日時" date, -- 更新日時
  "更新者" character varying(10), -- 更新者
  CONSTRAINT "ユーザマスタ_PKC" PRIMARY KEY ("ユーザID")
);

You can download this sample from here.