2

Is it possible to integrate Spring Security 3 and JSF 2, keeping JSF working as default, instead of show the new url when the user navigates, keep the old url, without using the redirect JSF attribute to navigate through pages?

I can't found documentation about this. All articles I found the author redirect the page when navigate.

Thanks

John John Pichler
  • 4,427
  • 8
  • 43
  • 72

1 Answers1

1

By default the FilterSecurityInterceptor will only execute once-per-request and doesn't do security re-checking unless there is change in the url but with JSP/JSF forwards the page is rendered as a response to the current request and the url in the browser contains the address of the previous page. So for this just set once-per-request attribute to false in your http element in applicationContext thus forcing security rechecking.

<http auto-config="true" use-expressions="true" once-per-request="false">

and add a dispatcher for forwards in springSecurityFilterChain filter-mapping in your web.xml 

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

More info

Alternatively, you can also enable page redirection by appending the parameter faces-redirect=true to the outcome like this:

<h:form>
    <h:commandButton action="page1?faces-redirect=true" value="Page1" />
</h:form>

But do also remember that in your case GET request looks more appropriate and as BalusC says its not good practice to use POST for bookmarkable page-to-page navigation.

So do GET using <h:link> or <h:button>or faces-redirect=true also causes a GET request.

Also see:

Community
  • 1
  • 1
Ravi Kadaboina
  • 8,494
  • 3
  • 30
  • 42
  • Sorry for delaying to test it. It have not worked. I still need to use the faces-redirect=true to get the security working. – John John Pichler Jul 09 '12 at 03:17
  • I'll accept your answer, but I always need to do page1?faces-redirect=true even with all this configuration. – John John Pichler Aug 31 '12 at 13:08
  • Yes Ed, I am sorry for that I will test it more extensively and open a bug with Spring. Or if you think you have done enough research please post a bug on their site and let me know. – Ravi Kadaboina Aug 31 '12 at 13:12