JSF - 为受限页面实现过滤器 [英] JSF - implementing filter for restricted pages

问题描述

我通过@BalusC回答，以限制未登录用户的页面。

I'm following answer by @BalusC to JSF 2.0: How to get the URL that is entered in the browser's address bar to restrict pages from users who are not logged in.

Filter：

Filter:

public class RestrictPageFilter implements Filter{
    FilterConfig fc;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        fc=filterConfig;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpreq = (HttpServletRequest) request;
        HttpServletResponse httpres = (HttpServletResponse) response;
        if (httpreq.getUserPrincipal() == null) {
            httpreq.getSession().setAttribute("from", httpreq.getRequestURI());
            httpres.sendRedirect("/pages/login.xhtml");
        } else {
            chain.doFilter(request, response);
        }
    }

    @Override
    public void destroy() {
        // TODO Auto-generated method stub
    }
}

web.xml：

<security-constraint>
    <web-resource-collection>
      <web-resource-name>Admin pages</web-resource-name>
      <url-pattern>/admin/*</url-pattern>
      <url-pattern>/restricted/*</url-pattern>
      <http-method>GET</http-method>
          <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>ADMIN</role-name>
    </auth-constraint>
  </security-constraint>

  <security-constraint>
    <web-resource-collection>
      <web-resource-name>User pages</web-resource-name>
      <url-pattern>/restricted/*</url-pattern>
      <http-method>GET</http-method>
          <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
      <role-name>ADMIN</role-name>
      <role-name>USER</role-name>
    </auth-constraint>
  </security-constraint>

   <!--login-config>
     <auth-method>FORM</auth-method>
     <realm-name>jdbc-realm</realm-name>
     <form-login-config>
       <form-login-page>/pages/login.xhtml</form-login-page>
       <form-error-page>/pages/error.xhtml</form-error-page>
     </form-login-config>
   </login-config-->

    <filter>
        <filter-name>RestrictPageFilter</filter-name>
        <filter-class>gov.denis.chanceryweb5.filter.RestrictPageFilter</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>RestrictPageFilter</filter-name>
        <url-pattern>/restricted/*</url-pattern>
    </filter-mapping> 

glassfish-web.xml

glassfish-web.xml

<glassfish-web-app>
<security-role-mapping>
    <role-name>ADMIN</role-name>
    <group-name>ADMIN</group-name>
  </security-role-mapping>
  <security-role-mapping>
    <role-name>USER</role-name>
    <group-name>USER</group-name>
  </security-role-mapping>

当访问我的网络应用程序，在浏览器中我出于某种原因看到这个？为什么？

When accessing my web app, in browser i see this for some reason? why?

推荐答案

您看到与BASIC身份验证方法关联的对话框。

You are seeing the dialog associated with the BASIC authentication method.

您目前已将web.xml文件的login-config元素注释掉......以便配置未被应用。

You currently have the login-config elements of your web.xml file commented out... so that configuration is not being applied.

GlassFish 3服务器具有默认的login-config当用户部署的应用程序指定了一个安全约束但未指定登录配置时使用它。

GlassFish 3 servers have a default login-config that is used when a user deployed app specifies a security-constraint but does not specify a login config...

您的应用程序的有效登录配置实际上看起来像这

The effective login-config for your app actually looks something like this

  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>file</realm-name>
  </login-config>

默认的login-config在 glassfish3 / glassfish / domains /< ;您的域名在这里> /config/default-web.xml

The default login-config is specified in glassfish3/glassfish/domains/<your domain name here>/config/default-web.xml

这篇关于JSF - 为受限页面实现过滤器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！