Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>If the filter is not invoked at all, i.e. the <code>doFilter()</code> method is never executed, then the filter mapping is plain wrong. You need to verify the <code>&lt;filter-mapping&gt;</code> in <code>web.xml</code>. It has to be mapped on either the <code>&lt;servlet-name&gt;</code> of the <code>FacesServlet</code> or on an <code>&lt;url-pattern&gt;</code> covering the restricted pages, such as <code>/app/*</code>, <code>/secured/*</code>, etc, depending on your folder structure.</p> <p>If the filter is indeed invoked, then your code logic flow is plain wrong. Let's look at your first attempt:</p> <pre><code>HttpSession session = req.getSession(false); if (!session.isNew()) { if(ManageCustomerMbeans.AUTH_KEY!=null){ chain.doFilter(req, resp); } } else { //Session has expired - redirect to login.jsp } </code></pre> <p>This flow is clearly wrong. First, you're getting the session with <code>false</code> which means that it can potentially return <code>null</code> but you are never checking on that. Then, you're checking if the session has recently been created which can <strong>never</strong> be <code>true</code> if <code>getSession(false)</code> returns a non-null session. So, the first <code>if</code> block is always entered. Then you're checking if a constant value is not null, but this can <strong>never</strong> be <code>false</code> as it's apparently a constant. So, your <code>chain.doFilter()</code> is <em>always</em> invoked. Assuming that the constant represents the attribute key, you need to rewrite it as follows:</p> <pre><code>HttpSession session = req.getSession(false); if (session != null &amp;&amp; session.getAttribute(ManageCustomerMbeans.AUTH_KEY) != null) { chain.doFilter(req, resp); } else { resp.sendRedirect(req.getContextPath() + "/login.jsp"); } </code></pre> <p>This will check if the session is not null and contains the logged-in user. If true, then continue the request, else redirect to the login page. You only need to make sure that the login page is not matched by the filter's mapping, else you need to add an extra check in the <code>if</code> block on the request URI.</p> <p>Your second attempt is also wrong:</p> <pre><code>if (!(pageRequested.contains("Login.jsp")&amp;&amp;session.getAttribute(ManageCustomerMbeans.AUTH_KEY)==null)) { resp.sendRedirect("./error"); } else { chain.doFilter(request, response); } </code></pre> <p>This will <strong>always</strong> redirect to the error page if the user is not entering the login page. This will only continue the request if the user is entering the login page while not logged-in. This logic makes no sense. But if you says that "it doesn't work", then it can only mean that the filter mapping is wrong.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload