title: Navigation in restricted area Java EE on Glassfish 4.1
body: <p>I am developing a webapp based on Java EE 7 on Glassfish 4.1. I'm new to this environment and I followed some guides to create a JDBC Realm based authentication.</p>
  
  <p>I have only one user role (named USER) that should be able to access all the XHTML pages in the /user folder.</p>
  
  <p>The problem is that when the user logs in, he is redirected to his personal homepage (until now everything is fine), but if I add any link to another page in the same /user folder I still have to login again! Also if I refresh the user's homepage I still have to login.</p>
  
  <p>How is it possible to resolve this problem? Am I missing something?</p>
  
  <p>Here is some code you may find useful to help me:</p>
  
  <p><em>web.xml</em></p>
  
  <pre><code>&lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;realm-name&gt;myJdbcRealm&lt;/realm-name&gt;
      &lt;form-login-config&gt;
          &lt;form-login-page&gt;/login.xhtml&lt;/form-login-page&gt;
          &lt;form-error-page&gt;/loginErr.xhtml&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Logged User&lt;/web-resource-name&gt;
          &lt;description/&gt;
          &lt;url-pattern&gt;/user/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;USER&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;USER&lt;/role-name&gt;
  &lt;/security-role&gt;
  </code></pre>
  
  <p><em>glassfish-web.xml</em></p>
  
  <pre><code>&lt;glassfish-web-app error-url=""&gt;
    &lt;class-loader delegate="true"/&gt;
    &lt;jsp-config&gt;
      &lt;property name="keepgenerated" value="true"&gt;
        &lt;description&gt;Keep a copy of the generated servlet class' java code.&lt;/description&gt;
      &lt;/property&gt;
    &lt;/jsp-config&gt;
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;USER&lt;/role-name&gt;
      &lt;group-name&gt;USER&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
  &lt;/glassfish-web-app&gt;
  </code></pre>
  
  <p><em>login.xhtml</em></p>
  
  <pre><code>&lt;h:form style="width: 500px; margin: auto; "&gt;
      &lt;p:panel header="Login Form"&gt;
          &lt;p:panelGrid columns="2" id="loginGrid"&gt;
              &lt;p:outputLabel for="usernameInput" value="Username"/&gt;
              &lt;p:inputText id="usernameInput" value="#{loginBean.username}" 
                           required="false" /&gt;
              &lt;p:outputLabel for="passwordInput" value="Password"/&gt;
              &lt;p:password id="passwordInput" value="#{loginBean.password}" 
                          required="false" /&gt;
              &lt;p:commandButton value="Login" 
                               action="#{loginBean.login()}" update="loginGrid" /&gt;
  
              &lt;p:messages/&gt;
          &lt;/p:panelGrid&gt;
      &lt;/p:panel&gt;
  &lt;/h:form&gt;
  </code></pre>
  
  <p><em>LoginBean.java</em></p>
  
  <pre><code>public String login() {
      FacesContext context = FacesContext.getCurrentInstance();
      HttpServletRequest request = (HttpServletRequest) context.getExternalContext().getRequest();
      try {
          request.login(this.username, this.password);
      } catch (ServletException e) {
          MessageBean.addError("Login failed");
          return NavigationBean.toLogin();
      }
      return "/user/home?faces-redirect=true";
  }
  </code></pre>