阻止用戶手動訪問頁面

Question

我已經實現了jsf階段偵聽器，該偵聽器檢查用戶是否插入，以及是否將用戶重定向到登錄頁面。

現在，我想實現相位偵聽器的情況下，用戶手動輸入地址欄中的頁面名稱 。在這種情況下，階段監聽器必須自動將用戶重定向到登錄頁面並銷燬會話。

在JSF中如何做到這一點？

Answer 1

我在JSF 1.2，並這樣做，是這樣的：

public void beforePhase(PhaseEvent event) 
{ 
    FacesContext fCtx = FacesContext.getCurrentInstance(); 
    String actualView = null; 
    actualView = event.getFacesContext().getApplication().getViewHandler().getResourceURL(fCtx, fCtx.getViewRoot().getViewId()); 
    //actualView is the page the user wants to see 
    //you can check, if the user got the permission, is logged in, whatever 
} 

public PhaseId getPhaseId() 
{ 
    return PhaseId.RENDER_RESPONSE; 
} 

Answer 2

只需使用一個簡單的servlet Filter這是對像/app/*受限頁面的常見URL模式映射，/pages/*，/secured/*，等這裏的一個開球的例子，假設你有@SessionScoped @ManagedBean UserManager。

@WebFilter(urlPatterns={"/app/*"}) 
public class AuthenticationFilter implements Filter { 

    @Override 
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { 
     HttpServletRequest request = (HttpServletRequest) req; 
     HttpServletResponse response = (HttpServletResponse) res; 
     HttpSession session = request.getSession(false); 
     UserManager userManager = (session != null) ? (UserManager) session.getAttribute("userManager") : null; 

     if (userManager == null || !userManager.isLoggedIn()) { 
      response.sendRedirect(request.getContextPath() + "/login.xhtml"); // No logged-in user found, so redirect to login page. 
     } else { 
      chain.doFilter(req, res); // Logged-in user found, so just continue request. 
     } 
    } 

    // ... 
}