JSF change relative path of resources of login via Spring security - jsf

Our application is a Jee application includes the following technologies:
Spring
Spring Security
JSF 2.2
Spring Webflow
Spring MVC
Before login , Resources (images,css,js,..) have been loaded successfully :
<link href="/titi/javax.faces.resource/layout/layout.css.xhtml?ln=primefaces&v=5.1" type="text/css" rel="stylesheet" />
<script src="/titi/javax.faces.resource/primefaces.js.xhtml?ln=primefaces&v=5.1" type="text/javascript"></script>
After Login , relative paths rendering was changed :
There is a new folder in the path which is /apps/ .
There is no .xhtml as extension .
__
<link href="/titi/apps/javax.faces.resource/layout/layout.css?ln=primefaces&v=5.1" type="text/css" rel="stylesheet" />
<script src="/titi/apps/javax.faces.resource/primefaces.js?ln=primefaces&v=5.1" type="text/javascript" ></script>
What is the configuration should be added for Spring Security to not interfere in resources path ?
Why /apps/ ?
I search on my code to understand why apps , i note that apps token from web.xml :
<servlet-mapping>
<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
<url-pattern>/apps/*</url-pattern>
</servlet-mapping>

You are taking the wrong approach and have the wrong assumptions. JSF and Spring MVC don't mix. See Using JSF as view technology of Spring MVC

Related

Upgrading JSF 1.2 to 2.x NullPointerException [duplicate]

I am working with a rather large app written in JSF 1.2.
JSF 1.2 is around 6 years old now. I need to upgrade to JSF 2.0. How painful will this be? I noticed that some attributes in custom tags have been changed etc.
Painfulness
Painfulness of upgrading JSF 1.2 to 2.0 depends on the view technology which you are currently using and which you want to use.
JSP 2.x to JSP 2.x = Almost no effort.
Facelets 1.x to Facelets 2.0 = Little effort.
JSP 2.x to Facelets 2.0 = Lot of effort. Double this if you also have custom components.
Basic changes
Regardless of the view technology switch, at least the following steps should be done:
Remove JSF 1.2 JAR's from /WEB-INF/lib (if any).
Drop JSF 2.0 JAR's in /WEB-INF/lib (if JSF 1.2 was servletcontainer-supplied, you might want to change the classloading policy to load webapp libraries first before servletcontainer libraries, see also JSF2 classloading issues in application servers).
Update root declaration of faces-config.xml to comply JSF 2.0 spec.
<faces-config
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_2_0.xsd"
version="2.0">
Note: when you're using JSF 2.2 or newer, use the http://xmlns.jcp.org namespace domain instead of http://java.sun.com throughout the above XML snippet.
Ensure that root declaration of web.xml already complies at least Servlet 2.5. JSF 2.0 won't work on 2.4 or lower (although it's hackable).
<web-app
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
id="YourWebappID"
version="2.5">
Note: when you're using Servlet 3.0 or newer, use the http://xmlns.jcp.org namespace domain instead of http://java.sun.com throughout the above XML snippet.
JSP 2.x to JSP 2.x
If you're using JSP 2.x and want to keep using it, then you basically don't need to change anything else.
Gradually upgrading
If you're already using a suffix url-pattern for the FacesServlet, like *.jsf, then it's good to know that the FacesServlet will first scan for *.xhtml file and if it is not present, then scan for *.jsp file. This provides you room to gradually convert from JSP to Facelets behind the scenes without changing the URL's.
But if you're using a prefix url-pattern, like /faces/* and you want to gradually upgrade from JSP to Facelets, then you really have to change it to *.jsf and possibly also all links in the existing JSP pages.
You only need to keep in mind that the new JSF 2.0 provided implicit navigation doesn't scan for the presence of the file, it will go to outcome.xhtml anyway. So if you want to come from or go to *.jsp, then you still need to include it in the viewid the JSF 1.x way.
Facelets 1.x to Facelets 2.0
If you're using Facelets 1.x as view technology and want to use the JSF 2.0 supplied Facelets 2.0, then you need to do the following additional steps:
Remove Facelets 1.x JAR from /WEB-INF/lib.
Remove Facelets 1.x FaceletViewHandler from faces-config.xml.
Any custom FaceletViewHandler implementation needs to be updated to extend ViewHandlerWrapper instead.
Not necessary, but just for cleanup, remove any Facelets 1.x related <context-param> values from web.xml which are already default in Facelets 2.0, like the javax.faces.DEFAULT_SUFFIX with value of *.xhtml.
Update root declaration of existing Facelet taglib XML's to comply Facelets 2.0.
<facelet-taglib
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facelettaglibrary_2_0.xsd"
version="2.0">
Note: when you're using JSF 2.2 or newer, use the http://xmlns.jcp.org namespace domain instead of http://java.sun.com throughout the above XML snippet.
That should basically be it.
JSP 2.x to Facelets 2.0
If you're using JSP 2.x as view technology and you want to upgrade to Facelets 2.0 immediately, then you need to do a lot of changes before the site can go live. You're basically changing the view technology here.
Master page changes
On every master page, you need to change the following basic JSP template..
<%#page contentType="text/html" pageEncoding="UTF-8"%>
<%#taglib prefix="f" uri="http://java.sun.com/jsf/core"%>
<%#taglib prefix="h" uri="http://java.sun.com/jsf/html"%>
<!DOCTYPE html>
<f:view>
<html lang="en">
<head>
<title>JSP page</title>
</head>
<body>
<h:outputText value="JSF components here." />
</body>
</html>
</f:view>
..to the following basic Facelets template:
<!DOCTYPE html>
<html lang="en"
xmlns="http://www.w3.org/1999/xhtml"
xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets">
<h:head>
<title>XHTML page</title>
</h:head>
<h:body>
<h:outputText value="JSF components here." />
</h:body>
</html>
Note: when you're using JSF 2.2 or newer, use the http://xmlns.jcp.org namespace domain instead of http://java.sun.com throughout the above XHTML snippets.
Include page changes
If your existing JSP pages are well designed, you should not have any line of scriptlet code and you should also have only the <jsp:include> as the sole JSP-specific tag. Any of those needs to be changed from:
<jsp:include page="include.jsp" />
to
<ui:include src="include.xhtml" />
The basic JSP include page template of..
<%#page contentType="text/html" pageEncoding="UTF-8"%>
<%#taglib prefix="f" uri="http://java.sun.com/jsf/core"%>
<%#taglib prefix="h" uri="http://java.sun.com/jsf/html"%>
<f:subview id="include">
<h:outputText value="JSF components here." />
</f:subview>
..should be changed to the following basic Facelets include page template:
<ui:composition
xmlns="http://www.w3.org/1999/xhtml"
xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets">
<h:outputText value="JSF components here." />
</ui:composition>
Note: when you're using JSF 2.2 or newer, use the http://xmlns.jcp.org namespace domain instead of http://java.sun.com throughout the above XHTML snippets.
Custom component changes
You need to change the JSP TLD files to Facelets TLD files as described in this Mojarra Migration Guide.
Aftermath
Regardless of the migration approach, you can gradually eliminate the faces-config.xml by the new JSF 2.0 annotations or even CDI. Any <managed-bean> can be annotated by #ManagedBean:
#ManagedBean(name="managedBeanName")
#RequestScoped
public class SomeBean {}
Next to #RequestScoped, there are also #ViewScoped, #SessionScoped and #ApplicationScoped available. If you omit the name attribute of the #ManagedBean, then it will default to classname with the 1st char lowercased.
#ManagedBean
#RequestScoped
public class SomeBean {}
In this particular example, it will be #{someBean}.
Any <managed-property> can be annotated using #ManagedProperty:
#ManagedProperty("#{otherBean}")
private OtherBean otherBean;
Any <validator> can be annotated using #FacesValidator:
#FacesValidator("someValidator")
public class SomeValidator implements Validator {}
Any <converter> can be annotated using #FacesConverter
#FacesConverter("someConverter")
public class SomeConverter implements Converter {}
Any <renderer> can be annotated using #FacesRenderer
#FacesRenderer(componentFamily="someComponentFamily", rendererType="someRendererType")
public class SomeRenderer extends Renderer {}
Any <navigation-case> which uses the filename of the XHTML page as both <from-outcome> and <to-view-id> can be removed since this will be implicitly done. This can be gradually done by changing all outcome values to match the filename of the target view.
Finally, any session scoped bean which was been put in the session with the sole reason to retain the bean data in subsequent requests in the same tab/window can better be marked #ViewScoped, because this way the bean won't be affected when the enduser opens the same page in different tabs/windows.
Component libraries
Note that I don't take any 3rd party componant libraries like PrimeFaces/RichFaces/IceFaces into account in this answer, it would then be impossible to write a reliable answer since it basically boils down to "it depends". In general it's sufficient to just upgrade the component library to a -by themselves verified- JSF 2.0 compatible version as per their instructions. Best is to just write unit tests, run them before and after the upgrade and fix any issues individually.
Here are at least some useful links with regard to migration of the specific component library:
RichFaces Migration Guide - 3.3.x to 4.x migration
IceFaces 2 Wiki - IceFaces 1.x Compatibility Guide
PrimeFaces has no migration guide for PrimeFaces 1.x to 2.x as PrimeFaces 1.x requires Facelets 1.x already, so you just have to follow Facelets 1.x to 2.x migration steps. However, there's a PrimeFaces 2.x to 3.x (and higher) migration guide which might apply as well on migrating from PrimeFaces 1.x to 3.x (or higher). Tomahawk has also no migration guide. Basically the only which you need to change are the JARs and if necessary get rid of all <t:saveState> references on a request scoped bean by making the bean view scoped.
One thing to mention is that if anyone is using JSTL with JSF 1.2 then when upgrading to JSF2 you should change the namespace from:
http://java.sun.com/jstl/core
to:
http://java.sun.com/jsp/jstl/core
JSF 2.0 have many new features and components and I don't feel migration will be painful. Only area you will find difficult is in using thrid party libraries. If your application is heavily dependant upon libraries like Richfaces then you will face problem. Not all the components from Richfaces 3 is ported to Richfaces 4.
This also might help
JSF 1.2 application migration to JSF 2.0
Also check this What is new in JSF 2?
Web.xml
Add the jars
1. jsf-api-2.0.jar
2. jsf-impl.2.0.2.jar
Step 1: Change web.xml
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
id="WebApp_ID" version="2.5">
<servlet>
<servlet-name>facesServlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>facesServlet</servlet-name>
<url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>facesServlet</servlet-name>
<url-pattern>*.jsf</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>facesServlet</servlet-name>
<url-pattern>*.faces</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>facesServlet</servlet-name>
<url-pattern>*.xhtml</url-pattern>
</servlet-mapping>
Step 2: webmvc-config.xml
<!-- Handles requests mapped to the Spring Web Flow system -->
<bean id="flowController" class="org.springframework.webflow.mvc.servlet.FlowController">
<property name="flowExecutor" ref="flowExecutor" />
<property name="ajaxHandler">
<bean class="org.springframework.faces.webflow.JsfAjaxHandler" />
</property>
</bean>
Step3:facess-config.xml
<faces-config xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_2_0.xsd" version="2.0">
If you are using Apache Trinidad you'll also have to upgrade it to version 2.0 so that it will support JSF 2.0. There's more info at Hacker's Valhalla.

Web Flow + JSF integration default page

I use Web Flow and JSF, so they works well actually. But I am trying to find out alternative way for set default page different from redirecting on index.html.
The main problem is web analytics scripts don't work properly. I can't track user source fore home page.
The application run on Tomcat 8
Web.xml
<welcome-file-list>
<welcome-file>index.html</welcome-file>
</welcome-file-list>
index.html
<html>
<head>
<meta http-equiv="Refresh" content="0; URL=web/home-page">
</head>
</html>
UPDATE :
I replace index.html with index.jsp and I set response status as 301. At least it works for google analytics, so I'll check it out for other analytics tools.
But this solution still did not satisfy me.
Web.xml
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
index.jsp
<%
response.setStatus(301);
String path=(String)request.getAttribute("javax.servlet.forward.request_uri");
if(path==null){
path="web/home-page";
}
response.setHeader( "Location", path);
response.setHeader( "Connection", "close" );
%>
I would use spring security project instead of welcome files because JSF (or any view framework) is not aware how to resolve a view in welcome-file that is why your logic is not executing.
A possible solution is if you are using the spring security project. Add the following to your security config
<security:http auto-config="true" use-expressions="true">
<!--- config omitted for brevity -->
<security:session-management invalid-session-url="/index.jsp"/>
</security:http>
Again this is just a sample. You can also use other means to define rules. It is quite modular
<security:intercept-url pattern="/**" ....
Moreover, you will need to define a classless controller with the following defintion: (assuming you also are using Spring MVC with Webflow)
<mvc:view-controller path="/index.jsp" />
I think it's less cryptic to define intercept,forward,routing, etc... rules all in Spring Security config that way it is clear that any such rules are stored in one place.
Note: you might be able to keep your current setup and use that spring <mvc:view-controller path="/index.jsp" /> definition only to trigger the JSF to execute.

Set HTTP headers properly to force caching on JS, CSS and PNG files

How can I tell to GlassFish server, to store all JS, CSS and PNG files into browser cache in order to reduce HTTP GET requests?
I am using JSF and PrimeFaces.
Just make use of JSF builtin resource handler. I.e. use <h:outputStylesheet name>, <h:outputScript name> and <h:graphicImage name> with files in /resources folder instead of "plain vanilla" <link rel="stylesheet">, <script> and <img>.
<h:outputStylesheet name="css/style.css" />
<h:outputScript name="js/script.js" />
<h:graphicImage name="images/logo.png" />
This way you don't need to worry about resource caching at all. JSF builtin resource handler has already set the necessary response headers. The expiration time defaults already to 1 week.
In Mojarra you can control the expiration time by the following context parameter (the value is in millis):
<context-param>
<param-name>com.sun.faces.defaultResourceMaxAge</param-name>
<param-value>3628800000</param-value> <!-- 6 weeks. -->
</context-param>
And in MyFaces:
<context-param>
<param-name>org.apache.myfaces.RESOURCE_MAX_TIME_EXPIRES</param-name>
<param-value>3628800000</param-value> <!-- 6 weeks. -->
</context-param>
See also:
How to reference CSS / JS / image resource in Facelets template?
What is the JSF resource library for and how should it be used?

how to enable browser caching in jsf

I have created a web application using JSF 2.0. I got feedback from my friend saying I should do "Browser Caching" as I have many images.
However I don't know how to do same in JSF. Any idea/ hint would be appreciated.
Concept on what to be done would also work.
Just use <h:graphicImage name="..."> instead of <img src="...">. This way the default JSF resource handler will instruct the browser to cache them for 1 week by default, which is configureable with an implementation dependent context parameter, which is the following in case of Mojarra:
<context-param>
<param-name>com.sun.faces.defaultResourceMaxAge</param-name>
<param-value>3628800000</param-value> <!-- 6 weeks -->
</context-param>
Note, the same applies when using <h:outputScript> and <h:outputStylesheet> instead of <script> and <link rel="stylesheet">.

How can I output a favicon <link> in the HTML head section using JSF 2.0?

Using h:outputStylesheet I can embed CSS resources in the HTML head section, but how can I build a <link> for a favicon image resource which renders HTML like in this example:
HTML output:
<head>
...
<link rel="icon" type="image/png" href="favicon.png" />
...
</head>
The image resource is located in <web>/resources/images.
If I use direct HTML code in the JSF template like href="/resources/images/favicon.png" the resource is not found - navigating to /resources/images/favicon.png leads to the error
/resources/images/favicon.png/index.jsf
not found
(I have set index.jsf as index page in web.xml which might explain this path)
Your webapp is apparently running on a non-empty context path. The leading slash / brings you to the domain root. Use #{request.contextPath} to dynamically inline the context path.
<link rel="shortcut icon" type="image/png" href="#{request.contextPath}/resources/images/favicon.png" />
(note that I fixed the rel as well to make it crossbrowser compatible)
The href="/resources/images/favicon.png" is actually looking in the root direcotry of your server http://localhost/resources/images/favicon.png and not inside your web application directory.
Your href location will need to include the web application directory href="/webappname/resources/images/favicon.png" http://localhost/webappname/resources/images/favicon.png
If your .xhtml file is in the same directory as your resources folder then removing the forward slash at the being should work as well.
href="resources/images/favicon.png"

Resources