title: Proper Login using servlets redirect to url
body: <p>I'm using apache tomcat and a servlet to check username and password from mysql database</p>
  
  <p>HTML page code:</p>
  
  <pre><code>&lt;form action="./login" method="POST"&gt;
      User name: &lt;input type="text" name="username" size="20"&gt;&lt;br&gt;
      Password: &lt;input type="password" name="pwd" size="20"&gt;
      &lt;br&gt;&lt;br&gt;
      &lt;input type="submit" value="Submit"&gt;
  &lt;/form&gt; 
  </code></pre>
  
  <p>Servlet Code:</p>
  
  <pre><code>import java.io.*;
  import javax.servlet.*;
  import javax.servlet.http.*;
  import java.sql.*;
  import java.io.*;
  public class VerifyLogin extends HttpServlet
  {
      public void doGet(HttpServletRequest req,HttpServletResponse res)throws IOException,ServletException
      {
          String n1 = req.getParameter("username");
          String n2 = req.getParameter("pwd");
          res.setContentType("text/html");
          PrintWriter out = res.getWriter();
  
          try
      {
          Class.forName("com.mysql.jdbc.Driver");
          Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/mydb","root","paSSword");
          PreparedStatement ps = con.prepareStatement("select * from auth WHERE username=? &amp;&amp; password=?");
          ps.setString(1,n1);
          ps.setString(2,n2);
          ResultSet rs = ps.executeQuery();
  
  
          if(rs.next())
          {
              res.sendRedirect("report.html");
  
          }   
          else
          {
              res.sendRedirect("Invalid.html");
          }
  
      }
          catch (Exception e)
          {
          System.out.println(e);
          }
  
      }
  }
  </code></pre>
  
  <p>web.xml code:</p>
  
  <pre><code>&lt;web-app&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Login&lt;/servlet-name&gt;
          &lt;servlet-class&gt;VerifyLogin&lt;/servlet-class&gt;
      &lt;/servlet&gt;
     &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Login&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/login&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>My directory structure is </p>
  
  <pre><code>=============&gt;tomcat
                 +webapps
                   +myapp
                     +
                     +report.html
                     +report2.html
                     +xxxx.html
                     +WEB-INF
                         +classes
                         +lib
                         +web.xml
  </code></pre>
  
  <p>I was able to successfully verify and  redirect a user to desired page( report.hmtl),the problem is when user copies the address after login say <a href="http://192.168.2.2:8080/myapp/Reports.html" rel="nofollow">http://192.168.2.2:8080/myapp/Reports.html</a> and paste the address in another browser he will not be asked to login .</p>
  
  <p>report.html has more links in it, which can be accessed wtihout login if some one knows the link. ALL the .html pages are placed outside WEB-INF folder how can i protect those from (example report2.html,xxx.html) from direct access? without converting the html pages to jsp</p>