0

I use JSF 2.2 & prettyfaces. I want to prevent security problems linked to browser backward functionality.

To resume the navigation link between my pages in my application : I have a login page done with Spring Security which redirects after connexion to a HomePage. The HomePage is in ViewScoped. From this HomePage , i can go to a AddPatientPage in ViewScoped and a AddAnalysePage in SessionScoped.

When the user is on the AddP*Page, if he clicks the browser backward button, i don't want to use cached page. I want a kind of redirection/ refresh of the page. I want the Homepage to use the initial values as it was a first load.

I'm trying to apply this solution without success... For example, when i get back to the HomePage from Add*Page, the values from the SelectOneMenu are not the initial ones, but the last selectioned. So i believe the cash is still use... Before to test , i cleared the cache files from browser.

Thanks for the help.

As BalusC in previous Post, i don't use annotation but directly referencing the filter in web.xml as above.

<filter>
     <filter-name>noCacheFilter</filter-name>
     <filter-class>com.clb.genomic.lyon.servletFilter.NoCacheFilter</filter-class>
</filter>
<filter-mapping>
     <filter-name>noCacheFilter</filter-name>
     <url-pattern>*.jsf</url-pattern>
    <url-pattern>*.xhtml</url-pattern>
</filter-mapping>

* EDIT :*

Using different words ,the problem is that when i use the backward button the values of the page components are not the same that its backing bean. So i don't understand which are kept tracked and which ones are not in the scope.

* EDIT2 :*

Ok , i let down the ajax call. The idea of the ajax call was that when you select a value in SelectOneMenu from a first form , you then inject the result to and other form with a second another SelectOneMenu and a commandButton to send all the values together. That was a mess to handle with backward button compatibility. So now i put the two selectOneMenu, in an unique form without ajax and it's working well...no problem with backward button and synchronisation between beans & page values of SelectOneMenu...

I hope someone have understand what was i trying to do :)

Community
  • 1
  • 1
ZheFrench
  • 1,164
  • 3
  • 22
  • 46
  • You're using a `@ViewScoped` bean to manage the page, however that kind of beans are deleted when a JSF navigation step is performed (means returning not null or empty String from an action method). However, Spring security doesn't work like that as it has its own POST method, so you can't ensure it's deleted when you access the application. I suggest you two workarounds: make it request scoped in order to make the managed bean stateless or make it session scoped and be sure to clear all the data when user logs in the app. – Aritz Oct 30 '13 at 08:11
  • I'm not sure the problem come from Spring Security.(In fact maybe...) Just to be clear, the system connexion works well. Each time I Log In , I'm redirect to HomePage and the values of some selection menus are good. It doesn't keep track of old action. The problem comes after when i navigate from Home to another page and try to go back to Home by backward button. But yes there is a Spring Security Filter , i need to investigate this a little more. But I can't change my HomePageScope because of ajax calls i'm doing on it..so i'm stucked – ZheFrench Oct 30 '13 at 08:47
  • So it's working if i used SessionScoped, i keeps the values from the beans & page synchronous. Cool , but the problem is that on my page, i request database in @PostConstruct annoted function to show some data. When i add some participant with the addparticipant page, the data is no more refresh on homePage because of the session scoped.(i need to log out to see the added data) It's was working with ViewScoped, but i have this problems with backward navigation and selectOneMenu init with ajax stuffs – ZheFrench Oct 30 '13 at 09:49

1 Answers1

2

If you are using PrettyFaces, the filter configuration won't work as expected. Typically you have some kind of pretty URL (for example /home) which then gets forwarded to the real JSF URL (for example /home.jsf).

With the configuration you posted the filter won't be applied to the forwarded requests. You have to update the configuration like this:

<filter>
     <filter-name>noCacheFilter</filter-name>
     <filter-class>com.clb.genomic.lyon.servletFilter.NoCacheFilter</filter-class>
</filter>
<filter-mapping>
   <filter-name>noCacheFilter</filter-name>
   <url-pattern>*.jsf</url-pattern>
   <url-pattern>*.xhtml</url-pattern>
   <dispatcher>REQUEST</dispatcher>
   <dispatcher>FORWARD</dispatcher>
</filter-mapping>
chkal
  • 5,598
  • 21
  • 26
  • Chrome throws me an ERR_CACHE_MISS and ask me to manually refresh the page. How i can go thought this ? [link](http://stackoverflow.com/questions/19215637/navigate-back-with-php-form-submission) – ZheFrench Oct 30 '13 at 08:28
  • This is because you need to make sure that your filter intercepts FORWARD dispatch types. – Lincoln Oct 30 '13 at 22:50