Home/ Questions/Q 6016721
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T03:01:25+00:00

I am new to JSF and Spring. I am trying to use Spring Security

  • 0

I am new to JSF and Spring. I am trying to use Spring Security with JSF. I have designed an XHTML page as below:

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
    xmlns:h="http://java.sun.com/jsf/html"
    xmlns:spring="http://www.springframework.org/tags"
    xmlns:form="http://www.springframework.org/tags/form">
<head>
    <title>JSF Test</title>
</head>
<body>
    <f:view>
    <p>This page should be authenticated!</p>
    <a href="<spring:url value="/j_spring_security_logout" htmlEscape="true" />">Logout</a>
    <div>Test: <spring:url value="/j_spring_security_logout" htmlEscape="true" /></div>
  </f:view>
</body>
</html>

I am trying to add a logout link using the spring:url tag. However, firstly this gives an error that href attribute cannot contain <. To troubleshoot this I removed the a tag and used the div to test whether I am able to get the desired value from the spring:url tag. I found that the spring:url tag is not being parsed and appears as it is in the source of the generated page.

Instead of using XHTML page if I use JSP page with taglibs instead of xmlns, everything works fine. I am not able to understand why it is not working with XHTML files.

My Faces Servlet is mapped to .jsf and springSecurityFilterChain is mapped to /* (without the space in between). I tried mapping springSecurityFilterChain to *.jsf and that too doesn’t help.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Facelets is a XML based view technology. Nesting tags as an attribute of another tag is invalid XML. All <spring:url> effectively does is prepending the context path, you could also do it yourself:

    <a href="#{request.contextPath}/j_spring_security_logout">Logout</a>

    The HTML escaping is not relevant since you are not passing any parameters through it.

    • 0