How to remove/prevent developer mode login in SRDemo?

Question

hi,
how can we prevent developer mode login in SRDemo since it is security risk?
How should we do that if we add ADF security to SRDemo?

Answer 1

hi,
I was looking at connectedUser info shown in top right corner and since it was not there (I set devMode in userInfo bean to false in order to prevent any login if wrong credentials) I (wrongly) assumed unauthenticated user accessed protected pages.
In my example I added Welcome and error40x pages to the application based on SRDemo. If the user enters wrong credentials in Login page he is dispatched to error401.jspx page.
On this page there is a link to index.jspx. By clicking on this link user is presented again with Login page but a message "Invalid username and password" is shown as well, probably caused by previous attempt.
If the user now enters correct credentials he is presented with Welcome page but currently connectedUser is not shown in top right corner (although user is apparently authenticated by container). It seems that Welcome backing bean which checks the role when user clicks the Start button is not invoked at all and the user stays at the same Welcome page although he is authorized to access the page corresponding to his role.
In order to get back to normal flow user have to logout first and only then he is presented with clean Login page and after that correct Welcome page showing currently connectedUser.
So my question is how to get back to "normal login flow" once the user is dispatched to error401.jspx page and he clicks the link to index.jspx or he clicks the Back button on the browser to go back to Login page?
Many thanks