Geek asks and answers

Restricting user access to pages by directly changing the URL in JSF

I have two kinds of users in my application - customers and sellers. I use PhaseListenerin JSF to prevent users from accessing pages without logging in, but after they logged in, I don’t know how to prevent the user from changing the URL in the location bar and accessing pages that he is not allowed to For example, preventing customers from accessing merchant pages.

Does anyone have an idea on how I can prevent such illegal treatment?

+5
source share
4 answers

/ ( , , , 't URL-, JSF).

, URL-, /seller/, , SELLER:

if (url.startsWith("/seller/") && user.getRoles().contains(Role.SELLER)) {
    // Allow access.
} else {
    // Block access.
}

, / , Java EE Apache Shiro. , , web.xml <security-constraint> , INI Shiro.

. :

+7

Filter. , javax.servlet.Filter doFilter() , , - . web.xml :

<filter>
  <filter-name>MyFilter</filter-name>
  <filter-class>mypackage.MyFilter</filter-class>
</filter>

<filter-mapping>
  <filter-name>MyFilter</filter-name>
  <url-pattern>*.xhtml</url-pattern>
</filter-mapping>
+1

-, ( 1 :

<entry key="acl_page_sub/page1">client,seller</entry>
<entry key="acl_page_sub2/page1">client</entry>
<entry key="acl_page_sub2/page2">seller</entry>

- LoginController, currentuserrole (url) . , - .

logincontroller faceconfig.

+1

, . prerenderview jsf2 post post jsf1.2

0

More articles:


All Articles