ExceptionFilter issues

[walterjwhite]

I am having issues with my ExceptionFilter and exceptions.  When a user does not have access to an item, I throw a security exception found below and want them to be shown the authorization error page.  The message I have configured does get shown so it appears this is working; however, it appears that it cannot find that page and is redirecting to the page not found page.

The interesting thing is, that whenever other exceptions occur, the generic error page works just fine as does the page not found.  When this happens, the address in the bar no longer references the rewritten url, but the actual path to the viewId.

I want to keep the user in the clean environment so they never see the actual path to the content as well as ensure they get the proper error page.

<exception class="org.jboss.seam.security.AuthorizationException">
          <redirect view-id="${page.error.authorization}">
               <message severity="ERROR">You don't have permission to do this</message>
          </redirect>
     </exception>

Any ideas?

Walter

[nico.ben]

Hi,
What's the value of ${page.error.authorization} when it doesn't find the page?

Bye
Nic

[walterjwhite]

I should have indicated, I am using maven in conjunction with properties, so that value is hard-coded at build-time to:

/errors/authorizationException.xhtml

It is simply a slightly modified error page from my generic error page:

/errors/error.xhtml

Both of those pages exist along with the templates.  JSF can be hard to debug, I bet if I enable trace for faces, I might be able to diagnose the problem.  There has to be an error in the xhtml file itself otherwise it wouldn't have redirected to the 404 page.

Walter

[nico.ben]

Hi,
have you put a breakpoint inside the method populating ${page.error.authorization} ?

Nic

[walterjwhite]

Actually here is the problem in my seam log at TRACE:

08:08:49,586 DEBUG [Navigator] redirecting to: /errors/authorizationException.xhtml 
08:08:49,589 DEBUG [FacesManager] redirecting to: http://localhost:8080/file/errors/authorizationException.xhtml ?conversationId=6

So, FacesManager is redirecting incorrectly.  I don't know why it works for some and not others.  I will see if I can enable debugging here.

Walter

[nico.ben]

Hi,
first of all put a <end-conversation/> after the exception tag like this, as you probably don't need to save the conversation:

<exception class="org.jboss.seam.security.AuthorizationException">
   <end-conversation/>
   <redirect view-id="${page.error.authorization}">
        <message severity="ERROR">You don't have permission to do this</message>
    </redirect>
</exception>

secondly, I notice a space in
http://localhost:8080/file/errors/authorizationException.xhtml ?conversationId=6
just right xhtml

check it out.

Bye
Nicola

[walterjwhite]

Hi,

The problem is coming from here:

FacesManager:line 168

 String url = context.getApplication().getViewHandler().getActionURL(context, viewId);

The action url is being generating incorrectly.

Walter

[walterjwhite]

I think I accidentally put that space in there, but I'll double check.

Walter

[walterjwhite]

The end conversation didn't help in this case.  I don't have a long-running conversation, so I'm not sure I would need that.  I'm double checking the javadoc for the ViewHandler.

Walter

[walterjwhite]

Well,

I guess the problem can be fixed in the Seam Pages class:

 if (!url.startsWith("/")) sb.append("/");
               
               sb.append(url);
               
               url = sb.toString();

The url is incorrect in the first place, so it's not entirely Seam's fault.  The url doesn't map to anything, so that's why I'm getting the 404.

I serve all files out of

/file/#{fileId}

and perform any authorization there to ensure users have access to files.  I think the problem might be from how my servlet is throwing the exception, let me double check this code and report back my findings.

Walter

[nico.ben]

Hi,
I forgot to ask your Seam version.
N

[walterjwhite]

I catch an instance of an AuthorizationException and wrap it in a ServletException before throwing that.  I saw some of my code send redirects if the file is not found, but that is not being evaluated as I found.  I'm not quite sure what else to check at this point.

I guess this may boil down to it, but when are you supposed to define error handling in pages.xml or in web.xml?  I'm guessing that if I move this error page from pages.xml to web.xml, that that will solve my problem.

Walter

[walterjwhite]

Sorry about that, I'm using Seam 2.2.0.GA on Jetty 7 (jetty maven plugin) and Richfaces 3.3.2.SR1.  My JSF version is 1.2.b19.

Walter

[nico.ben]

In pages.xml you should keep all the logic for the orchestration.

Nic

[walterjwhite]

Ok, I moved everything that doesn't require special handling to web.xml and it solved this issue.  I don't know if that is the right way to do it, but it appears to work.

Thanks,
Walter