chkal/pf-issue-test — Issue #16: Secured resources access via pretty-faces URLs
Author: chkal
Created: 2012-03-06 07:16:27+00:00
State: open

Originally filed by **aguiar.m...@gmail.com** on 2009-06-04T18:28:47

Google Code issue: http://code.google.com/p/prettyfaces/issues/detail?id=13

What steps will reproduce the problem?
1. Define a security constraint in web.xml

AdminUser

admin

/secure/admin/*
/faces/secure/admin/*
GET
POST

2. Map a pretty-faces URL to a secured URL

/manage
/faces/secure/admin/manage.xhtml

3. Access the management page via pretty-faces URL.

What is the expected output? What do you see instead?

I expected that a login page would appear as the final URL is a secured
resource, but I can access the page without a logged user.

A workaround is to secure the /manage resource too, but can't pretty faces
force that?