Prevent accessing restricted page without login in Jsf2

by

That depends on how you have programmed the login. You seem to be using homegrown authentication wherein you set the logged-in user as a property of a session scoped managed bean. Because with Java EE provided container managed login, preventing access to restricted pages is already taken into account.

Assuming that you’ve all restricted pages on a certain URL pattern, like /app/*, /secured/* etc and that your session scoped bean has the managed bean name user, then you could use a filter for the job. Implement the following in doFilter() method:

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    HttpSession session = request.getSession(false);
    User user = (session != null) ? (User) session.getAttribute("user") : null;

    if (user == null || !user.isLoggedIn()) {
        response.sendRedirect("/login.xhtml"); // No logged-in user found, so redirect to login page.
    } else {
        chain.doFilter(req, res); // Logged-in user found, so just continue request.
    }
}

Map this filter on an URL pattern covering the restricted pages.

Further, you need to ensure that you’ve disabled the browser cache on those pages, otherwise the enduser will still be able to see them from browser cache after logout. You can also use a filter for this. You could even do it in the same filter. See also Browser back button doesn’t clear old backing bean values.

More Related Contents:

  1. Migrating from JSF 1.2 to JSF 2.0
  2. Authorization redirect on session expiration does not work on submitting a JSF form, page stays the same
  3. Recommended JSF 2.0 CRUD frameworks [closed]
  4. Can I update a JSF component from a JSF backing bean method?
  5. JSF convertDateTime renders the previous day
  6. i18n with UTF-8 encoded properties files in JSF 2.0 application
  7. Execute managebean method from javascript onload event
  8. How I save and retrieve an image on my server in a java webapp [duplicate]
  9. Get current page programmatically
  10. JSF 2.0 set locale throughout session from browser and programmatically [duplicate]
  11. How to save state when extending UIComponentBase
  12. How to reference JSF managed beans which are provided in a JAR file?
  13. JSF 2: How show different ajax status in same input?
  14. Generic JSF entity converter [duplicate]
  15. Prevent suffix from being added to resources when page loads
  16. How to create a modular JSF 2.0 application?
  17. JSF files inside WEB-INF directory, how do I access them?
  18. Using JSF 2.0 / Facelets, is there a way to attach a global listener to all AJAX calls?
  19. Export to Excel JSF and PrimeFaces
  20. how to share a jsf error page between multiple wars
  21. JSF 2 – Bean Validation: validation failed -> empty values are replaced with last valid values from managed bean
  22. @EJB in @ViewScoped managed bean causes java.io.NotSerializableException
  23. Recursion in JSF (c:forEach vs. ui:repeat)
  24. is meta http-equiv value cache control is not supported?
  25. What is the ellipsis (…) for in this method signature?
  26. Selenium 2.53 not working on Firefox 47
  27. How to make spring inject value into a static field
  28. Filter (search and replace) array of bytes in an InputStream
  29. Android Call a method from another class
  30. What are the Java regular expressions for matching IPv4 and IPv6 strings?

Leave a Comment