I’m working on a JSF project, and it has a login.xhtml file, which a user login and go to a different page by his role.
Actually, I have four roles:
- Administrator
- Counter
- Client
- Cashier
Associated with four home pages:
- indexAdministrator.xhtml
- indexCounter.xhtml
- indexClient.xhtml
- indexCashier.xhtml
That’s working allright, but the problem is when a user that isn’t login. Go to page.xhtml directly from the URL, it enters, and I need only the users authorized do that.
If it’s something, I have two arguments in the Httpsession:
session.setAttribute("currentUser", currentUser);
session.setAttribute("role", role);
From the info you gave, I’d say your .xhtml pages aren’t checking if the user has permissions to see them. Put a check and redirect all who are not authorized.