Databases
StackOverflow2013
Postsdbo
POjsf filter seems not to work
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POjsf filter seems not to work
    text
    copied!<p>I was trying to create a secure login page with jsf, and I used these code snippets as the solution, found in <a href="https://stackoverflow.com/questions/1470591/basic-security-in-jsf">this question</a>. My problem is, that I can access the /restricted/secret.xhtml without logging in, there is no redirect it's like the filter is not applied, because if I go directly to the /restricted/secret.xhtml the #{user.loggedIn} evaluates to false and I still can view the page. Here is my code:</p> <p>AuthFilter.java</p> <pre><code>public class AuthFilter implements Filter { private FilterConfig config; @Override public void destroy() { this.config = null; } @Override public void doFilter(ServletRequest req, ServletResponse resp, FilterChain ch) throws IOException, ServletException { HttpSession s = ((HttpServletRequest) req).getSession(); if (s.getAttribute(UserBean.CREDENTIAL)==null) { ((HttpServletResponse) resp).sendRedirect("/login.faces"); }else { ch.doFilter(req, resp); } } @Override public void init(FilterConfig config) throws ServletException { this.config = config; } } </code></pre> <p>UserBean.java</p> <pre><code>@ManagedBean(name="user") @SessionScoped public class UserBean implements Serializable { private String name; private String password; protected static final String CREDENTIAL = "ontherun"; private static final long serialVersionUID = 1L; public String getName() { return this.name; } public void setName(String newName) { this.name = newName; } public String getPassword() { return this.password; } public void setPassword(String newPassword) { this.password = newPassword; } public boolean isLoggedIn() { return FacesContext.getCurrentInstance().getExternalContext() .getSessionMap().get(CREDENTIAL) != null; } public String logout() { FacesContext.getCurrentInstance().getExternalContext().getSessionMap().remove(CREDENTIAL); return null; } public String login() { FacesContext.getCurrentInstance().getExternalContext().getSessionMap().put(CREDENTIAL, this.name); return "secret"; } } </code></pre> <p>Here is my login.xhtml ; the page works correctly, so there is no problem with the template file.</p> <pre><code>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"&gt; &lt;html xmlns="http://www.w3.org/1999/xhtml" xmlns:ui="http://java.sun.com/jsf/facelets" xmlns:h="http://java.sun.com/jsf/html"&gt; &lt;head&gt;&lt;title&gt;IGNORED&lt;/title&gt;&lt;/head&gt; &lt;body&gt; &lt;ui:composition template="/templates/masterLayoutTemplate.xhtml"&gt; &lt;ui:define name="windowTitle"&gt; #{msgs.window_title} &lt;/ui:define&gt; &lt;ui:define name="header"&gt; &lt;ui:include src="/sections/login/header.xhtml"&gt;&lt;/ui:include&gt; &lt;/ui:define&gt; &lt;ui:define name="footer"&gt; &lt;ui:include src="/sections/login/footer.xhtml"&gt;&lt;/ui:include&gt; &lt;/ui:define&gt; &lt;ui:define name="content"&gt; &lt;h:form&gt; &lt;h:panelGrid columns="2"&gt; #{msgs.namePrompt} &lt;h:inputText id="name" value="#{user.name}"/&gt; #{msgs.passwordPrompt} &lt;h:inputSecret id="password" value="#{user.password}"/&gt; &lt;/h:panelGrid&gt; &lt;p&gt; &lt;h:commandButton value="#{msgs.loginButtonText}" action="#{user.login }"/&gt; &lt;/p&gt; &lt;p&gt; You are logged in : #{user.loggedIn} &lt;/p&gt; &lt;p&gt; &lt;h:commandButton value="logout" action="#{user.logout }"/&gt; &lt;/p&gt; &lt;/h:form&gt; &lt;/ui:define&gt; &lt;/ui:composition&gt; &lt;/body&gt; &lt;/html&gt; </code></pre> <p>Here is the secret.xhtml which is supposed to be restricted:</p> <pre><code>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"&gt; &lt;html xmlns="http://www.w3.org/1999/xhtml" xmlns:ui="http://java.sun.com/jsf/facelets" xmlns:h="http://java.sun.com/jsf/html"&gt; &lt;head&gt;&lt;title&gt;IGNORED&lt;/title&gt;&lt;/head&gt; &lt;body&gt; &lt;ui:composition template="/templates/masterLayoutTemplate.xhtml"&gt; &lt;ui:define name="windowTitle"&gt; #{msgs.window_title} &lt;/ui:define&gt; &lt;ui:define name="content"&gt; &lt;h:head&gt;&lt;/h:head&gt; &lt;h:body&gt; &lt;p&gt;You are #{user.loggedIn}&lt;/p&gt; &lt;/h:body&gt; &lt;/ui:define&gt; &lt;/ui:composition&gt; &lt;/body&gt; &lt;/html&gt; </code></pre> <p>And here are my config files: web.xml</p> <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt; &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"&gt; &lt;display-name&gt;OnTheRun&lt;/display-name&gt; &lt;servlet&gt; &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt; &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt; &lt;load-on-startup&gt;1&lt;/load-on-startup&gt; &lt;/servlet&gt; &lt;servlet-mapping&gt; &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt; &lt;url-pattern&gt;/faces/*&lt;/url-pattern&gt; &lt;/servlet-mapping&gt; &lt;welcome-file-list&gt; &lt;welcome-file&gt;faces/index.xhtml&lt;/welcome-file&gt; &lt;/welcome-file-list&gt; &lt;filter&gt; &lt;filter-name&gt;AuthFilter&lt;/filter-name&gt; &lt;filter-class&gt;on.run.AuthFilter&lt;/filter-class&gt; &lt;/filter&gt; &lt;filter-mapping&gt; &lt;filter-name&gt;AuthFilter&lt;/filter-name&gt; &lt;url-pattern&gt;/restricted/*&lt;/url-pattern&gt; &lt;/filter-mapping&gt; &lt;context-param&gt; &lt;param-name&gt;javax.faces.PROJECT_STAGE&lt;/param-name&gt; &lt;param-value&gt;Development&lt;/param-value&gt; &lt;/context-param&gt; &lt;/web-app&gt; </code></pre> <p>and faces-config.xml</p> <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt; &lt;faces-config xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_2_0.xsd" version="2.0"&gt; &lt;application&gt; &lt;resource-bundle&gt; &lt;base-name&gt;on.run.messages&lt;/base-name&gt; &lt;var&gt;msgs&lt;/var&gt; &lt;/resource-bundle&gt; &lt;/application&gt; &lt;navigation-rule&gt; &lt;from-view-id&gt;/index.xhtml&lt;/from-view-id&gt; &lt;navigation-case&gt; &lt;from-outcome&gt;login&lt;/from-outcome&gt; &lt;to-view-id&gt;/profile.xhtml&lt;/to-view-id&gt; &lt;redirect/&gt; &lt;/navigation-case&gt; &lt;/navigation-rule&gt; &lt;navigation-rule&gt; &lt;from-view-id&gt;/login.xhtml&lt;/from-view-id&gt; &lt;navigation-case&gt; &lt;from-outcome&gt;secret&lt;/from-outcome&gt; &lt;to-view-id&gt;/restricted/secret.xhtml&lt;/to-view-id&gt; &lt;redirect/&gt; &lt;/navigation-case&gt; &lt;/navigation-rule&gt; &lt;/faces-config&gt; </code></pre> <p>My directory structure looks like this: <a href="http://i48.tinypic.com/9hjomd.png" rel="nofollow noreferrer">dirStruct</a> <a href="http://i48.tinypic.com/9hjomd.png" rel="nofollow noreferrer">2</a></p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload