chkal/pf-issue-test — Issue #114: Deny unmanaged access to views
Author: chkal
Created: 2012-03-06 07:38:08+00:00
State: open

Originally filed by **christia...@gmail.com** on 2011-08-01T22:43:25

Google Code issue: http://code.google.com/p/prettyfaces/issues/detail?id=116

I would like to see a feature with which a specific pattern can be defined to deny direct access to views.
I think many people are missing something like:

This feature would have the effect, that only url mappings which are declared in the configuration(for paths starting with /admin) are accessible.

Here are an example config:

#{userBean.getAdminViewPathIfAuthorized}

#{userSessionBean.getAdminViewPathIfAuthorized}
#{navigationBean.getViewPath}

GET /admin/ => mappingId="admin" => return content of the view returned by userBean.getAdminViewPathIfAuthorized
GET /admin/index.xhtml => mappingId=null => 404 Error
GET /admin/test/ => mappingId="menu" => return content of the view returned by navigationBean.getViewPath or userSessionBean.getAdminViewPathIfAuthorized if the navigationBean.getViewPath returns null.

At the moment there is no pretty faces solution for this problem. Mainly it is necessary to offer a simple way for devs to deny direct access, so that only declared url mappings are processed and for the other requests it would probably be the best to just return 404 error.