{"id":50,"date":"2014-03-02T10:57:26","date_gmt":"2014-03-02T10:57:26","guid":{"rendered":"http:\/\/www.solewing.org\/blog\/?p=50"},"modified":"2014-07-08T18:51:17","modified_gmt":"2014-07-08T18:51:17","slug":"jsf-resources-and-security-constraints-in-web-xml","status":"publish","type":"post","link":"http:\/\/www.solewing.org\/blog\/2014\/03\/jsf-resources-and-security-constraints-in-web-xml\/","title":{"rendered":"JSF Resources and Security Constraints in web.xml"},"content":{"rendered":"<p>If your JSF application uses the standard Java Servlet security mechanisms (<code>&lt;security-role&gt;<\/code>, <code>&lt;security-constraint&gt;<\/code>, <code>&lt;login-config&gt;<\/code>, <em>et al<\/em>), and your application allows a mixture of public and non-public access, you&#8217;ll probably want to make the JSF resource library available to the browsers of both public and non-public users.<\/p>\n<p>Assuming that you&#8217;re using the JSF resource library mechanisms (like <code>&lt;h:outputStylesheet&gt;<\/code>), you&#8217;ll need this security constraint:<\/p>\n<p>[xml]<br \/>\n  <security-constraint><br \/>\n    <web-resource-collection><br \/>\n      <web-resource-name>Public Resources<\/web-resource-name><br \/>\n      <url-pattern>\/javax.faces.resource\/*<\/url-pattern><br \/>\n    <\/web-resource-collection><br \/>\n    <!-- don't specify an auth-constraint --><br \/>\n    <!-- you can specify a user-data-constraint if desired --><br \/>\n  <\/security-constraint><br \/>\n[\/xml]<\/p>\n<p>If (like me) you&#8217;re mixing use of JSF tags like (<code>&lt;h:outputStylesheet&gt;<\/code>) with some direct references to resources, you&#8217;ll also want to include a URL pattern that allows that direct access:<\/p>\n<p>[xml]<br \/>\n  <security-constraint><br \/>\n    <web-resource-collection><br \/>\n      <web-resource-name>Public Resources<\/web-resource-name><br \/>\n      <url-pattern>\/javax.faces.resource\/*<\/url-pattern><br \/>\n      <url-pattern>\/resources\/*<\/url-pattern><br \/>\n    <\/web-resource-collection><br \/>\n    <!-- don't specify an auth-constraint --><br \/>\n    <!-- you can specify a user-data-constraint if desired --><br \/>\n  <\/security-constraint><br \/>\n[\/xml]<\/p>\n<p>Since these security constraints don&#8217;t specify an auth constraint, they are accessible to any browser that requests them.  As noted, you can still include a <code>&lt;user-data-constraint&gt;<\/code> to enable SSL, if you like.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If your JSF application uses the standard Java Servlet security mechanisms (&lt;security-role&gt;, &lt;security-constraint&gt;, &lt;login-config&gt;, et al), and your application allows a mixture of public and non-public access, you&#8217;ll probably want to make the JSF resource library available to the browsers of both public and non-public users. Assuming that you&#8217;re using the JSF resource library mechanisms [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[10,2,13,12],"class_list":["post-50","post","type-post","status-publish","format-standard","hentry","category-jsf-2","tag-java-2","tag-jsf","tag-security-constraint","tag-servlet"],"_links":{"self":[{"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/posts\/50","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/comments?post=50"}],"version-history":[{"count":6,"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":61,"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/posts\/50\/revisions\/61"}],"wp:attachment":[{"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/media?parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/categories?post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.solewing.org\/blog\/wp-json\/wp\/v2\/tags?post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}