title: How to restrict unauthorized user to access page directly in jsf
body: <p>I am trying to restrict an user to access any pages if user if not authorized. I am using jsf 2.2 and primefaces. Below are my code:</p>
  
  <p><strong>My filter</strong></p>
  
  <pre><code>@WebFilter(filterName = "AuthFilter", urlPatterns = { "*.xhtml" })
  public class AuthFilter implements Filter {
  
      @Override
      public void init(FilterConfig filterConfig) throws ServletException {
      }
  
      @Override
      public void doFilter(ServletRequest req, ServletResponse res,
              FilterChain chain) throws IOException, ServletException {
          try {
  
  
              HttpServletRequest request = (HttpServletRequest) req;
              HttpServletResponse response = (HttpServletResponse) res;
              HttpSession session = request.getSession(false);
  
              String user = (session != null) ? session.getAttribute("username")
                      .toString() : null;
  
              String loginURL = request.getContextPath() + "/ldapLogin.xhtml";
              boolean loginRequest = request.getRequestURI().startsWith(loginURL);
              boolean resourceRequest = request.getRequestURI().startsWith(
                      request.getContextPath()
                              + ResourceHandler.RESOURCE_IDENTIFIER);
              if (user != null || loginRequest) 
                  chain.doFilter(request, response);
              } else {
                  response.sendRedirect(request.getContextPath()
                          + "/ldapLogin.xhtml");
              }
  
          } catch (Throwable t) {
              System.out.println(t.getMessage());
          }
      } 
  </code></pre>
  
  <p>Here my control is coming into the else condition when my session is not validated or If i am trying to access a page directly but Unable to redirect to <strong>ldapLogin.xhtml</strong></p>
  
  <p><strong>Web.xml</strong> </p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;javax.servlet.jsp.jstl.fmt.localizationContext&lt;/param-name&gt;
      &lt;param-value&gt;ApplicationResources&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;javax.servlet.jsp.jstl.fmt.fallbackLocale&lt;/param-name&gt;
      &lt;param-value&gt;en&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
               /WEB-INF/applicationContext-dao.xml,
               /WEB-INF/springLdap-security.xml
          &lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;javax.faces.PROJECT_STAGE&lt;/param-name&gt;
      &lt;param-value&gt;Development&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;javax.faces.STATE_SAVING_METHOD&lt;/param-name&gt;
      &lt;param-value&gt;client&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;javax.faces.DEFAULT_SUFFIX&lt;/param-name&gt;
      &lt;param-value&gt;.xhtml&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;javax.faces.FACELETS_LIBRARIES&lt;/param-name&gt;
      &lt;param-value&gt;
              /WEB-INF/taglibs/acegijsf.taglib.xml
          &lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;primefaces.THEME&lt;/param-name&gt;
      &lt;param-value&gt;bootstrap&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;context-param&gt;
      &lt;param-name&gt;org.omnifaces.FACES_VIEWS_SCAN_PATHS&lt;/param-name&gt;
      &lt;param-value&gt;/*.xhtml&lt;/param-value&gt;
    &lt;/context-param&gt;
    &lt;listener&gt;
      &lt;listener-class&gt;com.sun.faces.config.ConfigureListener&lt;/listener-class&gt;
    &lt;/listener&gt;
    &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
    &lt;/listener&gt;
    &lt;servlet&gt;
      &lt;servlet-name&gt;faces&lt;/servlet-name&gt;
      &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;faces&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.xhtml&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
    &lt;welcome-file-list&gt;
    &lt;welcome-file&gt;ldapLogin.xhtml&lt;/welcome-file&gt;
  </code></pre>
  
  <p><strong>LoginLdap.java</strong></p>
  
  <pre><code>public String ldapLoginAuthentcator() {
          if (contact != null) {
              HttpSession session = FilterUtil.getSession();
              session.setAttribute("username", user.getName());
              return "success";
          } else {
  FacesContext.getCurrentInstance().addMessage(null,
      new FacesMessage(FacesMessage.SEVERITY_WARN,"Invalid Login!", "Please TryAgain!"));
              return "login";
          }
  </code></pre>
  
  <p>Finally <strong>FilterUtil.java</strong> </p>
  
  <pre><code>public class FilterUtil {
  
        public static HttpSession getSession() {
     return(HttpSession)FacesContextgetCurrentInstance().getExternalContext().getSession(true);
        }
  </code></pre>
  
  <p>}</p>
  
  <p>I dont know what is the problem but when I trying to access a page and even if I am authorized or my session is not validated but still I can access the page. Any help would be appropriated. All pages are currently in same root path as a public not placed in web-inf folder.</p>
  
  <p>UPDATE:</p>
  
  <p>When I tried to access a page directly without a valid session, for example if I am trying to access <code>http://192.35.36.178:8042/SOW/start</code> and its coming to my filtering and successfully filtering but redirection is not happening , When I tried to check it with firebug its redirecting to some different planet. Its actually redirecting to </p>
  
  <pre><code> "http:172.36.98.658//8042/SOW/javax.faces.resource/theme.css.xhtml?ln=primefaces-bootstrap"
  </code></pre>
  
  <p>with status <strong>302 Found</strong> instead of redrecting to 
  response.sendRedirect(request.getContextPath()+ "/ldapLogin.xhtml")
  as well as when i tried to check the <strong>contextPath</strong>  its showing <strong>/sow</strong></p>