Jsf servlet override security contraints

Question

i've a jsf application with administration area that can be accessed only by the role admin, this is a part of the web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>Labometer</web-resource-name>
<url-pattern>/faces/labotat/*</url-pattern>
<url-pattern>/faces/labotat/admin/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Labometer</web-resource-name>
<url-pattern>/faces/labometer/*</url-pattern>
<url-pattern>/faces/labotat/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>role1</role-name>
</auth-constraint>
</security-constraint>
And this is a part of the faces-config.xml:
<navigation-rule>
<from-view-id>/labotat/*</from-view-id>
<navigation-case>
<from-outcome>config</from-outcome>
<to-view-id>/labotat/admin/config.jsp</to-view-id>
</navigation-case>
</navigation-rule>
the security constraints works if i write the url of admin pages directly in the browser, but not if i click a commandbutton that send me to ad administrative page.
Any suggestions?

Answer 1

Security constraints work from browser to server
requests. In your case, you are posting to first
page which fowards on server to second page. exactly, is the faces servlet that forward to the second page.
Since
the forward is happening on server, security
constraints do not apply. Use <redirec/> in your
faces-config.xml for navigavtion case and it should
workok it works, i didn't know the tag <redirect>.
Thank you very much!