jsf 2.0过滤器替代

Question

since filter only work well when i use page-redirect=true on every commandbuttons' action, i am looking for a usable alternative.

all i have now are two filters (which don't work well):

Filter A -> /pages/* (Filter checks if user is logged in)

Filter B -> /pages/restricted/* (filter checks if user has admin permissions)

because of the navigation-procedure by JSF they do not work, because the url is never changing.

my question is: what is the best solution to restict page access without filters (is there a easy to use security (without complex roles etc.-> some users just have isAdmin=true)? or is there no problem at all when i use redirection? why does jsf then doesn't use it per default?

Is using a prerenderview component an acceptible solution? (if the user dosn't have enough rights, he should be navigated to a 404 page)

Answer 1

You're making a fundamental mistake. You should not be using command (POST) buttons/links for page-to-page navigation in first place, but you should be using direct (GET) buttons/links for that.

Long story short:

• What is the difference between redirect and navigation/forward and when to use what?
• How to navigate in JSF? How to make URL reflect current page (and not previous one)
• When should I use h:outputLink instead of h:commandLink?

Considering this information and best practices, a servlet filter is still the best solution. All existing security frameworks are also based on the filter principle.

See also:

• How to handle authentication/authorization with users in a database?