JSF Servlet Pattern / weird requests -

currently want refactor project , remove /faces/ urls. reason simple, want avoid, users can "remove" faces part , see source of underlaying xhtml file.

i'm using shiro authentication. i'll first describe prior situation (that worked) , new one, that's causing troubles.

prior situation:

web.xml:

<servlet-mapping>     <servlet-name>faces servlet</servlet-name>     <url-pattern>/faces/*</url-pattern> </servlet-mapping> 

shiro.ini

[urls] /faces/index.xhtml = authc /faces/pages/** = authc /faces/templates/** = authc /faces/resources/** = authc 

current situation:

web.xml:

<servlet-mapping>     <servlet-name>faces servlet</servlet-name>     <url-pattern>*.xhtml</url-pattern> </servlet-mapping> 

shiro.ini

[urls] /index.xhtml = authc /pages/** = authc /templates/** = authc /resources/** = authc 

for people might have still "faces" bookmarks, added filter, , doing this:

httpservletrequest srequest = (httpservletrequest) request; httpservletresponse sresponse = (httpservletresponse) response;  string url = srequest.getrequesturi().trim(); system.out.println("filtering url: " + url);  if (url.contains("/faces/")){         url = url.replace("/faces/", "/");          system.out.println("redirecting to: " + url);         sresponse.setstatus(httpresponsecodes.sc_moved_permanently);         sresponse.sendredirect(url);     }else{         //no filtering required, proceed chain.         chain.dofilter(request, response);     } 

now, when cleared cache of browser, , call http://localhost/project/login.xhtml receive huge amount of attempts find xhtml files inside various resource folders:

12:27:46,735 info [stdout] (http--0.0.0.0-8090-6) filtering url: /project/resources/css/login.xhtml

12:27:46,737 info [stdout] (http--0.0.0.0-8090-6) filtering url: /project/resources/css/login.xhtml

12:27:46,836 info [stdout] (http--0.0.0.0-8090-6) filtering url: /project/resources/js/login.xhtml

12:27:46,837 info [stdout] (http--0.0.0.0-8090-1) filtering url: /project/resources/js/login.xhtml

...

which wrong. switching prior layout, keeping redirect filter not cause invalid requests.

it's because requests on jsf resources (css/js/image files) been blocked shiro , redirected login.xhtml. didn't notice css/js/images on login page has been disappeared?

you need map /javax.faces.resource/* requests anon user in top of shiro.ini.

/javax.faces.resource/** = anon