Security

Now, we'll see a solution to make our JSF pages and components secure. In Chapter 13, Working with Servlets and JSP, we exposed the security configuration of a web application in the web.xml descriptor file. As the Servlet specifications represent the base structure for the JSF applications, the web.xml remains an important configuration.

So, consider this security configuration in the web.xml descriptor file:

<security-constraint>
   <web-resource-collection>
      <web-resource-name>Authenticated</web-resource-name>
      <description></description>
      <url-pattern>/*</url-pattern>
   </web-resource-collection>
   <auth-constraint>
      <role-name>user</role-name>
      <role-name>admin</role-name>
      <role-name>guest</role-name>
   </auth-constraint>
</security...