What to do to restrict the user from seeing the page with out login the website?

Question

I want a page has to appear to user after logged in. But if we use that link we can see the page and its content only thing is that it wont be having user data. what to do to prevent this. what can be done in this scenario ?

Answer 1

I'm not familiar with JSF or if it has built in authentication/authorization. But you should be able to apply authentication/access rules directly on your web server.

Answer 2

Use a ServletFilter to check existence of UserData in Session.
If "yes: then forward else forward to error page.

Another option is to use the rendered attribute on tags to check the existence of UserData object.

Answer 3

You can declare a PhaseListener where to redirect to the homepage instead the user is not logged

public void afterPhase(PhaseEvent evt) {

    User user = 
        evt.getFacesContext().getExternalContext().getSessionMap().get(USER_KEY);

   if (user == null) {
        FacesContext.getExternalContext().redirect("home.xhtml");
   }
}

The phase listener can be defined globally, or at view-level with:

 <f:view afterPhase="#{bean.afterPhase}">...</f:view>

(in facelets the attribute is called afterPhaseListener)