Placing secure data in Java web application

Question

The question is about security in tomcat, but first consider the following example:

Suppose you have apache web server. Then, under www folder, create folder named dist, and under folder dist create folder named bdf23b1c-ddd3-4d5b-8fdf-948693674011. Under this folder create some files with secure information:

www/dist/bdf23b1c-ddd3-4d5b-8fdf-948693674011/pic.png

This is obviously bad idea, because any user can go to the yoursite.com/dist and see everything contained in this folder.

On the other hand, suppose the same situation, but with folder dist created inside tomcat web application. If you have the following in your web.xml:

<servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>/dist/*</url-pattern>some java tool from outside
</servlet-mapping>

then you can safely download pic.png using its URL. And if you go to yoursite.com/dist, then by default tomcat don't show you contents of this folder.

But my question is: how it is secure? Maybe you can just use some java tool from outside of the server to connect to tomcat and somehow determine full path of your precious data? I know about security in java and it will be the ultimate solution, but I don't want any password-based authentication here.

UPD #1: If some such hole (connecting with some java tool from outside or whatever) exist, please post it here. Suppose default tomcat installation with ROOT app replaced with our app. Maybe some tweaks to server.xml to forbid the unwanted connections of "malicious java tools"?

BTW, I already set up the firewall, that rejects all traffic to the site except for http, https and ssh.

UPD #2: As I mentioned in the comments, I want to create the cheapest possible alternative for dropbox functionality. I don't want to use passwords, because it can be inconvenient for our clients (we want to give the clients the pre-release access for our game)

Answer 1

What you are doing is "security through obscurity".

But in fact it will "work". Only the person knowing the URL will be able to download the file, as long as you make sure that directory listing is denied all time and that no link to the file exists somewhere where it could be picked up by a webcrawler like Google. And that nobody does scan the media where you share the link with your gf.

It is definitely not totally safe, depending on the type of data you want to share I would go for a different solution ...

Answer 2

First of all, you can configure Apache not to show the directory contents (I'm surprised it's on by default (apparently)), so there's no need for Tomcat here.

As for connecting to Tomcat from the outside, you're not going to allow that are you? You wouldn't leave your front door unlocked when you go to work either.

Lastly, the user would have to guess the path (and care enough about what's in there), so it's not very likely to leak out (except you've got to be careful about the webcrawlers as Marged pointed out).

Still, instead of relying on long cryptic paths, you could just configure Basic Authentication in Apache. That way you don't need to worry about Tomcat or Java.