securing ,html with jetty and shiro due to caching - jetty

Question

i am having issues securing my .html files with shiro.
my app is .html/jquery with rest calls.
user hit landing page redirects to /secure/index.html
user logs in.
user redirected to secure page /secure/index.html
user logouts and goes to /logout.html (shiro confirms logout)
type in browser address "/secure/index.html" and the page is
displayed despite being logged out.
at step5. the access,log is not showing any activity.
according to chrome developer tools the page is loading from cache.
the issue seems to be the browser is not reloading the page and hence shiro filter never gets to fire, and the contents of the secure html file is visible.
it is very evident that the browser cache bypasses the shiro auth.
only if i Ctl+F5 refresh will the page be reload from jetty and security is activated.
shiro.ini
======================
authc.loginUrl = /login.html
authc.usernameParam = username
authc.passwordParam = password
authc.rememberMeParam = remember
logout.redirectUrl = /logout.html
Solution #1
my solution was to force the browser to have a 'no-cache'on the .html files.
however i want cache control for my static content.
i know the DefaultServlet can do this so i created another 2 instances of the DefaultServlet (staticDefaultServlet and webDefaultServlet) to server different cache-control headers for my content.
<servlet>
<servlet-name>webDefaultServlet</servlet-name>
<servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
<init-param>
<param-name>cacheControl</param-name>
<param-value>max-age=5,no-store</param-value>
</init-param>
<init-param>
<param-name>pathInfoOnly</param-name>
<param-value>true</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<servlet-name>staticDefaultServlet</servlet-name>
<servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
<init-param>
<param-name>cacheControl</param-name>
<param-value>max-age=604800</param-value>
</init-param>
<init-param>
<param-name>pathInfoOnly</param-name>
<param-value>true</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>staticDefaultServlet</servlet-name>
<url-pattern>/static/**</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>webDefaultServlet</servlet-name>
<url-pattern>/pages/**</url-pattern>
</servlet-mapping>
however the cache headers are not coming thru.
Questions
Q1. can i use multiple instances of DefaultServlet to have different each control for different paths?
Q2. Is there another mechanism to protect .html files with shiro?
thanks
-lp

Answer 1

this is too difficult.
i abandoned the defaultservlet solution and instead used a Filter to manage my cacheControl for different paths.
public class CacheControlFilter implements Filter
{
String cacheControl;
//#Override
public void init(FilterConfig filterConfig) throws ServletException
{
cacheControl = filterConfig.getInitParameter("cacheControl");
}
//#Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException
{
if (response instanceof HttpServletResponse)
{
HttpServletResponse httpResponse = (HttpServletResponse) response;
httpResponse.addHeader("Cache-Control", cacheControl);
}
chain.doFilter(request, response);
}
and deployed in web.xml
<filter>
<filter-name>WebCacheControlFilter</filter-name>
<filter-class>com.asteriski.itaxreport.filter.CacheControlFilter</filter-class>
<init-param>
<param-name>cacheControl</param-name>
<param-value>no-cache, no-store, must-revalidate</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>WebCacheControlFilter</filter-name>
<url-pattern>/pages/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
-lp