Hiding a view servlet in a Java MVC web application?

Question

I'm using a very simple MVC framework, Bear Bibeault's Front Man, which, for those not familiar, is pretty similar to Spring MVC (in concept at least).

For most cases, I am using a JSP as my view. To prevent direct access to the view, I place the JSP files inside the WEB-INF directory.

However, in some cases I need to use a servlet to represent my view. For instance I have a view servlet that generates PDF, which you shouldn't do in JSP. The problem I'm having is these views are directly accessible by typing the name of the view in the URL. Granted the view throws an exception because it doesn't have a proper model in the request (since it is not hitting the model building page controller), but I would like the view servlet to be hidden from the user, much like my JSP views are.

How do I prevent direct accessing of the view servlet?

---

Related Question:

Protecting internal view layer template pages in servlet applications

Answer 1

First step is to use a proper security model to prevent access to your files. Rather than using the side-effect of the WEB-INF directory being inaccessible as a URL (Which, BTW, is not guaranteed to work for all web servers) you should use the & elements in your web.xml file to define which directories can or can't be accessed via a direct URL.

Once you've done this, you should be able to map your PDF view to a URL, protect that URL, via your web.xml file, then forward to the view form your MVC controller/action (Much like you forward to your JSPs)

See the Sun site for more info on the security constraint.