I mean
if any client tries to go to any other page ( without going through the login page ) he should be redirected back to login page.
I am a newbie to jsf , and i dont know jsp either. Is jsp, and struts a must to knowing jsf.
Do we need to make change to web.xml for this?
security-constraint>
<!-- protected resources -->
<web-resource-collection>
<url-pattern>/pages/protected/*</url-pattern>
</web-resource-collection>
<!-- required credentials -->
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
will changing these lines will help solve my purpose. How will the redirection to login page be handled.
I have absolutely no idea in this regard.
Thanks for replying
Panks.T
If the question is still not clear...
lemmet put it again.
I have resource , i want user to access those resource pages only after authentication through /index.jsp page.
if any user tries to access the protected resource , he should be asked to login through this index.page again and then reach the respective page he requested.
I dont want the coding to be repetitive in all jsp pages. Is there some controller servlet or something which acts at the front for all pages.
any ideas?
I'am using both a javax.servlet.Filter and a PhaseListener. The Filter controls access to Pages depending on the privileges of the current user, the PhaseListener checks some request parameters especially a token. Maybe it's possible and better to move the functionality of the Filter to the PhaseListener.
Found this:
http://www.nabble.com/OWASP-standards-t3040481.html
There is a additional link to
http://www.us.apachecon.com/presentations/TH19/TH19-OWASP-updated.ppt
which topic is
"Securing MyFaces Applications Against the OWASP Top Ten"
An example for Filter is found in "JavaServer Faces in Action" by Kito D. Mann in part 3 chapter 13.2 "Adding security".
You can't access FacesContext in Filter because it will be initialised later in FacesServlet.
You can use HttpServletRequest.getPathInfo(). That will become the viewId of UIViewRoot. Don't forget that the viewId will change during navigation and you have to check permissions again in JSF.