]> git.mxchange.org Git - addressbook-war.git/blob - web/WEB-INF/web.xml
added some http-only configuration to avoid common XSS
[addressbook-war.git] / web / WEB-INF / web.xml
1 <?xml version="1.0" encoding="UTF-8"?>
2 <web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
3     <description>An online address book application to share private and business memebers between all members. It is also possible that the user's profile can be made visible to outside.</description>
4     <display-name>Addressbook Application v1.0</display-name>
5     <context-param>
6         <param-name>javax.faces.PROJECT_STAGE</param-name>
7         <param-value>Development</param-value>
8     </context-param>
9     <servlet>
10         <servlet-name>Faces Servlet</servlet-name>
11         <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
12         <load-on-startup>1</load-on-startup>
13     </servlet>
14     <servlet-mapping>
15         <servlet-name>Faces Servlet</servlet-name>
16         <url-pattern>/faces/*</url-pattern>
17     </servlet-mapping>
18     <session-config>
19         <session-timeout>
20             30
21         </session-timeout>
22         <cookie-config>
23             <http-only>true</http-only>
24         </cookie-config>
25     </session-config>
26     <welcome-file-list>
27         <welcome-file>faces/index.xhtml</welcome-file>
28     </welcome-file-list>
29     <security-constraint>
30         <display-name>LoginConstraint</display-name>
31         <web-resource-collection>
32             <web-resource-name>loginArea</web-resource-name>
33             <description>Login area</description>
34             <url-pattern>/llogin/*</url-pattern>
35         </web-resource-collection>
36         <auth-constraint>
37             <description>User Authentication</description>
38             <role-name>user</role-name>
39         </auth-constraint>
40     </security-constraint>
41     <security-constraint>
42         <display-name>AdminConstraint</display-name>
43         <web-resource-collection>
44             <web-resource-name>admin</web-resource-name>
45             <description>Administrative area</description>
46             <url-pattern>/admin/*</url-pattern>
47         </web-resource-collection>
48         <auth-constraint>
49             <description>Admin authentication</description>
50             <role-name>admin</role-name>
51         </auth-constraint>
52     </security-constraint>
53     <login-config>
54         <auth-method>FORM</auth-method>
55         <realm-name>Loginbereich / Login area</realm-name>
56         <form-login-config>
57             <form-login-page>/user/login.xhtml</form-login-page>
58             <form-error-page>/user/login_error.xhtml</form-error-page>
59         </form-login-config>
60     </login-config>
61     <security-role>
62         <description>A logged-in user that has previously registered himself/herself.</description>
63         <role-name>user</role-name>
64     </security-role>
65     <mime-mapping>
66         <extension>tpl</extension>
67         <mime-type>text/plain</mime-type>
68     </mime-mapping>
69     <security-role>
70         <description>Administrativre rule</description>
71         <role-name>admin</role-name>
72     </security-role>
73 </web-app>