Filters and authentication

Question

          Hello.
          To our knowledge, a request for a servlet is followed by an authentication done
          by the web server (for example Base / Form authentication etc.).
          We are interested in using the filtering mechanism (javax.servlet.Filter).
          Our question is: What happens before what when a request is made by a client:
          Filtering and then authentication, or authentication an then filtering
          a) client -> filter -> authentication -> servlet
          or
          b) client -> authentication -> filter -> servlet
          Thanks in advance,
          Ilana and Natalie
          

Answer 1

Hi nikita,
I have delt with the same problem before. As you say, most JSF actions all get posted back to the original page, and the faces servlet internally redirects according to the navigation rules and actions. This can mean the URL seen by the browser does not always correspond to the actual JSP (wrapped by JSF) that produced the content.
Generally adding the "<redirect/>" tag to all your navigation rules (in faces-config.xml) remedies this, so the actions are still posted back to the original page, but then the JSF servlet sends an http-redirect to the browser before invoking the new page. This way, the URL is always in sync, and the security constraints defined in your web descriptor always get invoked properly.
regards,
tony