Handling JSF page getting blank after Session has expired

Question

I have JSF pages which have links to other JSF pages . When I click on the link and if the session has already expired , control goes to login page. And I will login with username password and again come to same page where I have clicked on link. Now I will click on the link, a blank page is getting displayed, and if i do page refresh by F5, the expected page loads.

And also I have checked the console on my Jboss server, the View Expired exception is not appearing.

SO I am bit confused which way I handle this to avoid blank page getting displayed.

Please help.

Answer 1

This can happen if you're performing link navigation by ajax and the page returned after login was been served from the browser cache (and thus contains a form with an outdated view state identifier). You need to tell the browser to not cache restricted pages. You can achieve this with the following filter:

@WebFilter(servletNames={"Faces Servlet"})
public class NoCacheFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;

        if (!req.getRequestURI().startsWith(req.getContextPath() + ResourceHandler.RESOURCE_IDENTIFIER)) { // Skip JSF resources (CSS/JS/Images/etc)
            res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
            res.setHeader("Pragma", "no-cache"); // HTTP 1.0.
            res.setDateHeader("Expires", 0); // Proxies.
        }

        chain.doFilter(request, response);
    }

    // ...
}

Note that this problem thus also suggests that you're using (ajax) command links for page-to-page navigation. This is a bad practice. Those links are not SEO friendly nor bookmarkable. Command links should be used for form submits only. Use normal links for page-to-page navigation. See also When should I use h:outputLink instead of h:commandLink?

Answer 2

@BaluSC : Thanks for the reply.

Used h:outputLink wherever possible.
And also I have handled the ViewExpiredException through the tag in web.xml.

<error-page>
    <exception-type>java.lang.Exception</exception-type>
    <location>/ErrorHandler</location>
  </error-page>

<servlet>
    <servlet-name>ErrorHandler</servlet-name>
    <servlet-class>com.common.beans.ErrorHandler</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>ErrorHandler</servlet-name>
    <url-pattern>/ErrorHandler</url-pattern>
  </servlet-mapping>

Used a servlet which handles this exception and redirects to the same page and loads the page properly. And the doGet method of Servlet checks for ViewExpiredException.

public void doGet(HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException
 {

      if (request.getAttribute("javax.servlet.error.exception") != null
         && request.getAttribute("javax.servlet.error.exception")
            .toString().contains("ViewExpiredException"))
      {

            String[] attributes =
               request.getAttribute("javax.servlet.error.request_uri")
                  .toString().split("/");
            StringBuilder redirectViewId = new StringBuilder("");
            for (int i = 2; i < attributes.length; i++)
            {
               redirectViewId.append("/").append(attributes[i]);
            }
            response.sendRedirect(FacesUtils.getFullRequestUrl(request)
               + redirectViewId);
         }
}