User restriction page when logged in

Question

My website contains two type of users, user and admin. I'm trying to restrict the user from accessing admin control page, and I tried to do it like this inside doFilter():

System.out.print("\nNumber of objects constructed:->" + Counter.show() + "\n\n");
String path = req.getRequestURI().substring(req.getContextPath().length());

if (path.startsWith("/faces/xadmin.xhtml") && !JloginDAO.per.equals("admin")) {
    res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
}

if (path.startsWith("/faces/calendar.xhtml") && !JloginDAO.per.equals("admin")) {
    res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
}

but it's not working, and no errors showing!

web.xml

 <display-name>web2</display-name>
 <servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
  <servlet-name>Faces Servlet</servlet-name>
<url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<servlet>
    <description></description>
    <display-name>DisplayImage</display-name>
    <servlet-name>DisplayImage</servlet-name>
    <servlet-class>calender.DisplayImage</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>DisplayImage</servlet-name>
    <url-pattern>/DisplayImage</url-pattern>
</servlet-mapping>

 <servlet>
    <description></description>
    <display-name>PrivateDisplayImage</display-name>
    <servlet-name>PrivateDisplayImage</servlet-name>
    <servlet-class>displayCalendar.PrivateDisplayImage</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>PrivateDisplayImage</servlet-name>
    <url-pattern>/PrivateDisplayImage</url-pattern>
</servlet-mapping>

     <servlet>
    <description></description>
    <display-name>PublicDisplayImage</display-name>
    <servlet-name>PublicDisplayImage</servlet-name>
    <servlet-class>public_display_Calendar.PublicDisplayImage</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>PublicDisplayImage</servlet-name>
    <url-pattern>/PublicDisplayImage</url-pattern>
</servlet-mapping>


<session-config>
    <session-timeout>
        30
    </session-timeout>
</session-config>
 <filter>
   <filter-name>PrimeFaces FileUpload Filter</filter-name>
   <filter-class>org.primefaces.webapp.filter.FileUploadFilter</filter-class>
  <init-param>
  <param-name>thresholdSize</param-name>
  <param-value>10240</param-value> <!-- 10 Mb -->
</init-param>
 </filter>
   <filter-mapping>
   <filter-name>PrimeFaces FileUpload Filter</filter-name>
    <servlet-name>Faces Servlet</servlet-name>
  </filter-mapping>
   </web-app>

Any ideas?

Do you really want `FacesServlet` to listen to this URL pattern `/faces/*` and not `*.xhtml`? — Tiny, Dec 27 '14 at 21:38
There is currently only one filter `org.primefaces.webapp.filter.FileUploadFilter` in `web.xml`. Do you happen to use an annotation with an appropriate URL pattern such as `@WebFilter(filterName = "FilterName", urlPatterns = {"/YourPattern*"}...)`? — Tiny, Dec 27 '14 at 21:46
when I tried the URL pattern `*.xhtml` it gives me error Not Found in ExternalContext as a Resource — Jason, Dec 27 '14 at 21:49
Don't you have this annotation `@WebFilter` before your filter class in which you are supposed to have that code (the first code snippet)? After changing the pattern to `*.xhtml`, you should be accessing pages using URLs that correspond to that pattern (if you insist upon using `*.xhtml`). — Tiny, Dec 27 '14 at 22:02
I do it's `@WebFilter(filterName = "AuthFilter", urlPatterns = {"*.xhtml"})` and I changed the URL pattern to `*.xhtml`, it works but I don't see the content of the page and an error is showing up in the console `viewId:/index.xhtml - View /index.xhtml could not be restored.` — Jason, Dec 27 '14 at 22:37
Nope. The URL pattern of that filter is to be restricted only to those resources that you want to protect (as you mentioned). Hence, it should not be `*.xhtml` (this pattern is supposed to be applied to `FacesServlet` - not mandatory again. Only if you like). Thus the URL pattern of that filter should represent only those resources which are supposed to be stored under a directory with an intention to protect them such as `/admin/*` (`urlPatterns = {"/admin/*"}`) (or whatever depending upon your directory structure). — Tiny, Dec 27 '14 at 23:50
That exception in your last comment is a broad thing. Head to [this](http://stackoverflow.com/q/3642919) question, if you still get that exception. — Tiny, Dec 27 '14 at 23:50

score 1 · Accepted Answer · answered Dec 27 '14 at 23:29

1

Make sure your url pattern is like this:

<url-pattern>*.xhtml</url-pattern>

and your webfilter like this

@WebFilter(filterName = "AuthFilter", urlPatterns = {"*.xhtml"})

Your code never invoked because it's out side the try{}, make sure you have your code under req definition.

answered Dec 27 '14 at 23:29

Moodi1409

155
1
10

Uh! that URL pattern here `urlPatterns = {"*.xhtml"}` is going to be applied globally to all the pages which end up with the `.xhtml` extension/suffix. Thus the filter would be invoked whenever a page with an `.xhtml` extension is requested from anywhere throughout the application. The filter is however, only supposed to be invoked whenever a page with an `.xhtml` suffix is requested from a restricted area such as `/admin/*`. – Tiny Dec 28 '14 at 00:05
@user2453286 and Moodi1409 and [this](http://stackoverflow.com/users/3609903/user3609903) too : Please do not try to make others a fool who happen to invest some time here (avoid those joined account tricks just to grab reputation). How did you accept this answer? There is nothing about this exception too `viewId:/index.xhtml - View /index.xhtml could not be restored`. How did you solve it? This is a too generalized pattern `*.xhtml` which covers all the pages which end with `.xhtml` (not only those stored in a restricted structure)? I will personally stay away from your questions/answers :( – Tiny Dec 28 '14 at 00:35

User restriction page when logged in

1 Answers1