JSF - Logoff

Question

I'm looking for the best way to provide security to a JSF app. With JSP, I could check the session object to determine is the user was still active or valid, and if not I could just forward them to my logoff.jsp page. How can I do this in JSF effectively?
If I follow the JSF Navigation rules, then I can only navigate using action()'s, but this step comes after the constructor, the PVC's, and the ActionListeners. How can I check for the user to be logged in in the constructor and move directly to a navigation step for anything on my page?
Are there any best practices on using INCLUDE's for security sake at the top of JSF pages?
Thanks.

Answer 1

You could use JAAS. Tomcat's Admin Web App does the same.
you could use Realms (XML file, Database,...)
provide on index.jsp something like:
<form method="POST" action='<%= response.encodeURL("j_security_check") %>'  name="loginForm">
        <input type="text" name="j_username" size="16" id="username"/>
        <input type="password" name="j_password" size="16" id="password"/>
               <input type="submit" value='logon>
</form>use web.xml for protecting access:
  <security-constraint>
    <display-name>My WEB APP</display-name>
    <web-resource-collection>
      <web-resource-name>Protected Area</web-resource-name>
      <!-- Define the context-relative URL(s) to be protected -->
      <url-pattern>*.jsp</url-pattern>
      <url-pattern>*.jsf</url-pattern>
      <url-pattern>*.html</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>theRoleILikeToEnable</role-name>
    </auth-constraint>
  </security-constraint>
  <!-- Login configuration uses form-based authentication -->
  <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>myRealm</realm-name>
    <form-login-config>
      <form-login-page>/index.jsp</form-login-page>
      <form-error-page>/error.jsp</form-error-page>
    </form-login-config>
  </login-config>
  <!-- Security roles referenced by this web application -->
  <security-role>
    <role-name>theRoleILikeToEnable</role-name>
  </security-role>Now your pages are save...
okay, now you need logoff.
use a button, like (<h:commandButton) and bind its action to a Backing Bean method
#{controllerBean.logoff} inside of logoff do like:
public String logoff(){
// Invalidate the current session and create a new one
        HttpServletRequest request = (HttpServletRequest)FacesContext.getCurrentInstance().getExternalContext().getRequest
        HttpSession session =  request.getSession();
        session.invalidate();
        session = request.getSession(true);
return ("foo");
}I guess this the simplest way. But you also could enhance JSF infrastructure ViewHandler e.g
Or create a jsf component that checks the users. But each page must contain this tag (component)
HTH.
Matthias