java - Primefaces 登录身份验证 Servlet 过滤器 - 仍然可以通过 URL 直接访问 protected 页面

Question

我有三个 primefaces(4.0 版)网页。其中一个是 login.xhtml，我想用它来验证用户身份，然后才允许他们访问其他两个网页中的任何一个。我使用的是Tomcat服务器(v7.0)

我的问题是我可以从我的基本网址访问login.xhtml:http://localhost:8080/controlservice-server/--> 它执行正确的用户身份验证，然后通过进入正确的网页。

但是，我可以直接从其他两个网页的网址访问它们，而无需通过登录页面，因此任何人都可以访问它们。

我的 web.xml:

<context-param>
        <param-name>javax.faces.PROJECT_STAGE</param-name>
        <param-value>Development</param-value>
    </context-param>

<welcome-file-list>
        <welcome-file>Login.xhtml</welcome-file>
    </welcome-file-list>

<servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>

<servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>*.jsf</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>*.faces</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>*.xhtml</url-pattern>
    </servlet-mapping>

我的身份验证 Web 过滤器:

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

@WebFilter(filterName = "PrimefacesAuthFilter", urlPatterns={"*.Login.xhtml"})
public class PrimesfacesAuthFilter implements Filter {

  public PrimesfacesAuthFilter() {
  }

  @Override
  public void init(FilterConfig filterConfig) throws ServletException {
  }

  @Override
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    try {

      HttpServletRequest req = (HttpServletRequest) request;
      HttpServletResponse res = (HttpServletResponse) response;
      HttpSession ses = req.getSession(false);

      String reqURI = req.getRequestURI();
      if (reqURI.indexOf("/*.xhtml") >= 0 || (ses != null && ses.getAttribute("username") != null)
          || reqURI.indexOf("/public/") >= 0 || reqURI.contains("javax.faces.resource")) {

        chain.doFilter(request, response);
      }
      else
        res.sendRedirect(req.getContextPath() + "/login.xhtml");
    } catch (Throwable t) {
      System.out.println(t.getMessage());
    }
  }

  @Override
  public void destroy() {

  }

}

Answer 1

您应该更改 @WebFilter 注释中的 urlPatterns 属性，如下所示:

@WebFilter(filterName = "PrimefacesAuthFilter", urlPatterns={"*.xhtml"})