Question

I creating a web application using JSF,Hibernate,Spring. I have added a filter for checking session. My Filter code is :

public class AdminFilter implements Filter{

     private ArrayList<String> urlList;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
       String urls = filterConfig.getInitParameter("avoid-urls");
       StringTokenizer token = new StringTokenizer(urls, ",");   
       urlList = new ArrayList<String>();

        while (token.hasMoreTokens()) {
            urlList.add(token.nextToken());  
        }
    }

    // Checking if user is logged in
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
                HttpServletRequest req= (HttpServletRequest) request;
        HttpServletResponse resp= (HttpServletResponse) response;
        String url = req.getServletPath();
        HttpSession session =   req.getSession();
                if(!urlList.contains(url) && session.getAttribute("user")==null) 
                {
                    resp.sendRedirect(req.getContextPath() + "/backend/login/index.xhtml");

                }
          chain.doFilter(req, resp);
    }

    @Override
    public void destroy() {
       // throw new UnsupportedOperationException("Not supported yet.");
    }

}

In the init method of filter i have some avoid URL for which session checking should be skipped, like for login page itself. This is working correct but this filter is restricting my CSS,images and JS to load on the login page.
Suggest me what is the problem in my filter ?

Answer 1

Your login page needs some resources (CSS, JS, Images) which are requested from browser in separate request which will be intercepted by Filter and since you don’t have any parameters that skips such requests for resources (being used on login page) it will block this request

Suggestion:

You could use Spring-Security, rather than investing time in writing yours, it has got lots of flexibility by configuration