This AuthenticationFilter also runs when login.html is being requested. However, the code is redirecting to login.html once again instead of continuing the filter chain. This explains the infinite redirect loop. You need to let the filter just continue the request if the currently requested page is already the login page itself. E.g. public void doFilter(ServletRequest … Read more
The org.springframework.web.servlet.HanderInterceptor Interface JavaDoc itself has a two paragraphs that discuss this question: HandlerInterceptor is basically similar to a Servlet 2.3 Filter, but in contrast to the latter it just allows custom pre-processing with the option of prohibiting the execution of the handler itself, and custom post-processing. Filters are more powerful, for example they allow … Read more
The GZIP filter that I use to compress resources in my webapps: public class CompressionFilter implements Filter { public void destroy() { } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletResponse httpResponse = (HttpServletResponse) response; String acceptEncoding = httpRequest.getHeader(HttpHeaders.ACCEPT_ENCODING); if (acceptEncoding != null) { if … Read more
How do I write a filter which will appropriately cache static resources as recommended by Google If you mean with JSF resources the files in /resources folder which are fully handled by JSF builtin resource handler (and thus all referenced via <h:outputStylesheet>, <h:outputScript>, <h:graphicImage>, #{resource} and thus not via the plain HTML way), then you … Read more
Well, this is a pretty broad subject. As you’re starting off with homebrewed authentication, I’ll target the answer on homebrewed authorization. Role checking in Java/JSF is at its own relatively simple if the model is sensibly designed. Assuming that a single user can have multiple roles (as is often the case in real world applications), … Read more
First, you need to save the status code in an accessible place. The best to wrap the response with your implementation and keep it there: public class StatusExposingServletResponse extends HttpServletResponseWrapper { private int httpStatus; public StatusExposingServletResponse(HttpServletResponse response) { super(response); } @Override public void sendError(int sc) throws IOException { httpStatus = sc; super.sendError(sc); } @Override public … Read more
Servlet filters are implementation of the chain of responsibility pattern The point is that each filter stays “in front” and “behind” each servlet it is mapped to. So if you have a filter around a servlet, you’ll have: void doFilter(..) { // do stuff before servlet gets called // invoke the servlet, or any other … Read more
You can’t delete headers afterwards by the standard Servlet API. Your best bet is to just prevent the header from being set. You can do this by creating a Filter which replaces the ServletResponse with a custom HttpServletResponseWrapper implementation which skips the setHeader()‘s job whenever the header name is Content-Disposition. Basically: @Override public void doFilter(ServletRequest … Read more
If you’re homegrowing HTTP request authentication on top of JSF, then a servlet filter is really the best approach. JSF is “just” a MVC framework and nothing in the JSF API is been specified to filter incoming HTTP requests to check user authentication. On normal GET requests, a JSF managed bean is usually only constructed … Read more
There are three ways: Use WebApplicationContextUtils: public void init(FilterConfig cfg) { ApplicationContext ctx = WebApplicationContextUtils .getRequiredWebApplicationContext(cfg.getServletContext()); this.bean = ctx.getBean(YourBeanType.class); } Using the DelegatingFilterProxy – you map that filter, and declare your filter as bean. The delegating proxy will then invoke all beans that implement the Filter interface. Use @Configurable on your filter. I would prefer … Read more