Question

Goal: User tries to access page without authentication. Site redirects to login page, when they enter details they are returned to the page they were trying to access.

I have a filter which records the last url the user was at in the session. The following code is how i get the uri.

String uri = request.getRequestURI().toString();
String queryString = request.getQueryString();  
String completeUri = uri;
if (queryString != null)
{
    completeUri += "?" + queryString;
}

In practice this filter seams to be catching external css files, individual images on a page etc so about half the time it works and half the time its pointing to an image or css file.

The mapping for the filter is…

<filter>
    <filter-name>ComprehensiveFilter</filter-name>
    <filter-class>core.website.control.filter.ComprehensiveFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>ComprehensiveFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

So question is. Why does my code store images and external files instead of the url the user was just at? I assume it has something to do with my mapping of the filter.

Answer 1

You should use this code only in case you detect unauthorized access and redirect to the login page. And you should pass it as param, like response.sendRedirect("login.jsp?" + completeUri)

Now, if the filter is applied to every resource (as you do), it will be triggered for images and css files that are included in the login.jsp. You must exclude the login.jsp itself from this redirection (otherwise you will enter a loop), and you must also exclude the css files. This depends on your URL scheme.

• if all your pages are .jsp, then map the filter to *.jsp
• if your actions to through a single servlet (like a dispatcher servlet), then map the filter to that servlet (instead of <uri-pattern> set <servlet-name>)
• if you have “pretty urls”, then (in the filter) check if the requested resource ends with .css, .png, .gif etc, and don’t enter the redirection logic.