Home/ Questions/Q 7732199
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T06:40:21+00:00

Are there some issues if I insert some check into the template file? For

  • 0

Are there some issues if I insert some check into the template file? For example if I insert the user check into the template’s xhtml file it could be some security issue if I use this template in ALL my xhtml pages?

Something like:

<?xml version='1.0' encoding='UTF-8' ?> 
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:ui="http://java.sun.com/jsf/facelets"
      xmlns:h="http://java.sun.com/jsf/html">
    <h:head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
        <title><ui:insert name="title">Default Title</ui:insert></title>
        <h:outputStylesheet name="css/jsfcrud.css"/>
    </h:head>
    <h:body>
        <h:panelGroup rendered="#{userBean.cognome!=null}">
            Utente connesso:<h:outputText value="#{userBean.cognome}"/>&nbsp;<h:outputText value="#{userBean.nome}"/>
            <h1><ui:insert name="title">Default Title</ui:insert></h1>
            <p><ui:insert name="body">Default Body</ui:insert></p>
        </h:panelGroup>
    </h:body>
</html>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I understand that you’re checking the presence of the logged-in user before displaying the content. This may be okay this way, but any user who opens the page without being logged-in will receive blank content. This is not very user friendly. You’d like to redirect a non-logged-in user to the login page.

    This is normally already taken into account if you’re using Java EE provided container managed authentication. But if you’re homegrowing authentication, you’d need to create a servlet filter for this. If you collect all restricted pages in a common folder like /app so that you can use a common URL pattern for the filter, e.g. /app/* (and put all public pages such as the login page outside this folder), then you should be able to filter out non-logged-in users as follows, assuming that #{userBean} is a session scoped JSF @ManagedBean or some session attribute which you’ve put in session scope yourself:

    @WebFilter("/app/*")
public class LoginFilter implements Filter {

    @Override
    public void init(FilterConfig config) throws ServletException {
        // NOOP.
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        HttpSession session = request.getSession(false);
        UserBean user = (session != null) ? (UserBean) session.getAttribute("userBean") : null;

        if (user == null || user.getCognome() == null) {
            response.sendRedirect(request.getContextPath() + "/login.xhtml"); // No logged-in user found, so redirect to login page.
        } else {
            chain.doFilter(req, res); // Logged-in user found, so just continue request.
        }
    }

    @Override
    public void destroy() {
        // NOOP.
    }

}

    See also:

    • 0