› KCM ComposerUI for ASP.NET Developer's Guide › Securing KCM ComposerUI › Securing custom applications › Exposing web URLs

Exposing web URLs

In the KCM ComposerUI ASP.NET application that is running in Secure Mode, content in the application folder is not exposed to the web by default. To expose a certain file through a web URL, it must be listed in the file securemode-urls.xml, which can be found in the root of the application folder. Changes to this file are applied when the application is deployed. This can be done from the KCM ComposerUI ASP.NET main configuration page.

The following format of the file securemode-urls.xml is supported: 

<?xml version="1.0" encoding="UTF-8" ?> 
<itp:secure-mode-urls xmlns:itp=
   "http://www.aia-itp.com/namespaces/online-secure-mode-urls/1"> 
  <itp:exposed> 
    <itp:pattern pattern="/modelbegin.aspx" /> 
    <itp:pattern pattern="/css/*.css" /> 
    <itp:pattern pattern="*.js" /> 
  </itp:exposed> 
</itp:secure-mode-urls>

This example contains three itp:pattern entries. Each itp:pattern entry specifies a pattern for URLs that are exposed. All URL patterns are specified relative to the application folder.

Three types of patterns are supported: single URLs, sets of URLs in a specific folder, and sets of URLs in any folder.

  • A single URL pattern exposes a single URL in the application. A single URL pattern always starts with a slash (/), and specifies the entire path to the URL that should be exposed. For instance, the first entry in the example specifies pattern /modelbegin.aspx. Because the path is relative to the application folder, this exposes the URL /itp/app/<application name>/modelbegin.aspx. The pattern only exposes the exact URL that is specified, so the example pattern /modelbegin.aspx does not expose /itp/app/<application name>/some/folder/modelbegin.aspx.

  • A pattern may also specify a set of URLs in a specific folder. This type of pattern also starts with a slash (/), and specifies the entire path to the application subfolder in which URLs should be exposed. Instead of specifying a single URL within the folder, a set of URLs is specified by using wildcard characters. For instance, the second itp:pattern entry in the example specifies the pattern /css/*.css. This exposes all URLs in the application subfolder /css that end with extension .css, but no URLs in any other folders.

    To specify a set of URLs, patterns can use wildcard characters * and ?. The character * matches any sequence of characters. The character ? matches a single character. In addition, URL patterns can use the construct (a|b|c|...|z) to allow for multiple alternatives. For instance, the pattern /(modelbegin|modelend).aspx can be used to expose both /modelbegin.aspx and /modelend.aspx.

  • The third type of pattern exposes a set of URLs in any folder of the application. This type of pattern does not start with a slash (/) and does not specify a path. The pattern specifies only the pattern of the exposed URLs, which are then exposed in all application subfolders. This is shown in the third entry itp:pattern entry in the example. The specified pattern *.js exposes all files that end with .js, in all folders of the application.