title: JSF security : page redirect vs. page forward
body: <p>I'm new with JSF and I would like to understand why page redirect and page forward do not produce the same security render.</p>
  
  <p>I have a JSF button which calls backing method :</p>
  
  <pre><code>&lt;h:form&gt;
      &lt;!-- content... --&gt;
      &lt;p:commandButton action="#{login.play}" ... /&gt;
  &lt;/h:form&gt;
  </code></pre>
  
  <p>Login managed bean</p>
  
  <pre><code>public String play() {
     ...
     //forward implementation
     return "play";
  }
  
  public String play() {
     ...
     //redirect implementation
     return "play?faces-redirect=true";
  }
  </code></pre>
  
  <p>My page <code>play.xhtml</code> is secured. Only roles <code>admin</code> or <code>user</code> can access it but with my first <code>play</code> method, the security constraint is not enabled, I can access. Why is it different?</p>