Thread: How to block the JSP being called by GET method

Hi Guys ... I have an existing JSP which is coded like this.

/<%
if( (request.getParameter("userid")!=null) && (request.getParameter("token")!=null) ) {

session.setParameter("USERID", request.getParameter(userid);
session.setParameter("Token", request.getParameter(token);

send.redirect(another.jsp);
}
/%>

< ----- here i have the normal HTML contents where i ask for userid from the user
and upon clicking submit, java script function openwindow() is called ----- >

function openwindow(){

< -- here i open a modal window which calls a URL with userid (get method)
and as return value i get userid and token back.
Now i set this to document.Parent.userid and document.Parent.token --- >

document.Parent.userid = retval.userid;
document.Parent.token = retval.token;
Parent.submit();
}

With the above mentioned JSP, I face a problem that when I invoke the JSP using sample.jsp?userid=dhfgd&token=dhdhd, the control directly goes to another.jsp since the request parameters are set.

To avoid this, kindly suggest me a probable solution without making much changes in code. Thanks in advance

I'm not sure if I completely understand your question... Are you asking for the way to disable GET requests to a JSP file so that the userid and token parameters cannot be provided to the JSP file via URL query string, but can be provided as POST parameters?

If that's the question, then you can either set up a security constraint in the web application's deployment descriptor (web.xml), or add a servlet filter to filter out GET requests. Details at How to disable GET requests to JSP page? - Stack Overflow. Internet search term used: "jsp disable get".

I resolved it by checking whether the same is GET or post inside success of request.getParameter if case. Blocked it when the request is GET. Thanks for your suggestion.