Faces 3 + Soteria: redirect on viewexpired on ajax request

[pizzi80]

Actually Soteria do not manage this, which is the best place to implement the correct "ajax" redirect?

something like the one proposed by BalusC

https://stackoverflow.com/questions/13366936/jsf-filter-not-redirecting-after-initial-redirect/13369719#13369719

String loginURL = req.getContextPath() + "/login/login.xhtml";

if (!authenticated && !req.getRequestURI().equals(loginURL)) {
    if ("partial/ajax".equals(request.getHeader("Faces-Request"))) {
        res.setContentType("text/xml");
        res.getWriter()
            .append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>")
            .printf("<partial-response><redirect url=\"%s\"></redirect></partial-response>", loginURL);
    } else {
        res.sendRedirect(loginURL);
    }
} else {
    chain.doFilter(request, response);
}

[arjantijms]

We had that in a prototype in Soteria along with an issue in Faces to be able to pop a dialog if needed for authentication. Unfortunately the person assigned to it vanished in thin air, so the issue was never finished.

Would however still be good to look at again.

[pizzi80]

The redirect logic is inside LoginToContinueInterceptor

What I see is that inside Soteria/Utils there are 2 o 3 methods that implements a redirect and the
the one that shoud be used for JSF is not called, at least in my fork which is based on v2.0

So I think we should call the right method which is the one at line 186 of Utils of the master

Probably I should fix it in my fork and wait for Jakarta ee 10 to see if in the meantime has been fixed

[arjantijms]

What I see is that inside Soteria/Utils there 2 o 3 methods to do a redirect and the
the one that shoud be used for JSF is not called,

That's "correct" in the sense that we started that work there, but because of the thin air event never finished it. Its leftover is in the code still.

[pizzi80]

ok, it works, it's just a matter of call the other Utils.redirect method
inside HttpMessageContextImpl

@Override
    public AuthenticationStatus redirect(String location) {
        //Utils.redirect(getResponse(), location);
        Utils.redirect(getRequest(),getResponse(),location);

        return SEND_CONTINUE;
    }

and in Utils a little check to avoid NPE inside isFacesAjaxRequest

public static boolean isFacesAjaxRequest(HttpServletRequest request) {
    if ( request == null ) return false;

    String facesHeader = request.getHeader("Faces-Request");
    return facesHeader != null && FACES_AJAX_HEADERS.contains(facesHeader);
}