Authorization failures during JSF form submissions: A comprehensive analysis

When implementing custom authorization mechanisms in JSF applications, it is crucial to understand the distinction between page navigation and form submissions. While redirects work seamlessly for page navigation, they can encounter issues during form submissions.

Cause of the Problem

The root cause of this issue lies in the fact that JSF form submissions trigger asynchronous requests. When a redirect is sent as a response to an asynchronous request, the JSF AJAX engine expects a specific XML response. However, sending a regular HTML page violates this expectation, resulting in the user remaining on the same page.

The Wrong Tool for the Job

Using a custom servlet to perform authorization checks introduces additional complexity and potential issues. Instead, the recommended approach is to utilize a servlet filter specifically designed for this purpose. Filters offer a more robust and efficient means of intercepting incoming requests.

A Comprehensive Filter Implementation

Below is an example of a servlet filter that handles authorization checks effectively:

@WebFilter("/*")
public class AuthorizationFilter implements Filter {

  private static final String AJAX_REDIRECT_XML = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
        "<partial-response><redirect url=\"%s\"></redirect></partial-response>";

  @Override
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws ServletException, IOException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    HttpSession session = request.getSession(false);
    String loginURL = request.getContextPath()   "/login.xhtml";

    boolean loggedIn = (session != null) && (session.getAttribute("user") != null);
    boolean loginRequest = request.getRequestURI().equals(loginURL);
    boolean resourceRequest = request.getRequestURI().startsWith(request.getContextPath()   ResourceHandler.RESOURCE_IDENTIFIER   "/");
    boolean ajaxRequest = "partial/ajax".equals(request.getHeader("Faces-Request"));

    if (loggedIn || loginRequest || resourceRequest) {
      // Continue request.
      chain.doFilter(request, response);
    } else if (ajaxRequest) {
      // Send special XML response to instruct JSF AJAX to redirect.
      response.setContentType("text/xml");
      response.setCharacterEncoding("UTF-8");
      response.getWriter().printf(AJAX_REDIRECT_XML, loginURL);
    } else {
      // Perform стандартный синхронный редирект.
      response.sendRedirect(loginURL);
    }
  }

}

Additional Resources for Consideration

For further insights into this topic, refer to the following resources:

• [Using JSF 2.0 / Facelets, is there a way to attach a global listener to all AJAX calls?](https://stackoverflow.com/questions/11687648/using-jsf-2-0-facelets-is-there-a-way-to-attach-a-global-listener-to-all-ajax-calls)
• [FullAjaxExceptionHandler does not show session expired error page on ajax button](https://stackoverflow.com/questions/25366069/fullajaxexceptionhandler-does-not-show-session-expired-error-page-on-ajax-button)