Search code examples
springrichfacesjsf-2.2spring-web

Console errors when refreshing login page after upgrading to JSF 2.2 and RF 4.5.7

I have recently upgraded a web application from JSF 1.2 to JSF 2.2 as well as RF 3.3.3 to RF 4.5.7. I'm currently experiencing console errors when loading the first login.html page. This only happens when either the page is first loaded or when I refresh (F5 or shift F5). When I log in and log out again I don't receive these errors! The URL is exactly the same, e.g. host:port/xxx/login.html

This issue only occurs on this page. I'm using Spring (3.1.0) for the login although not sure if the issue is related. Security config in applicationContext.xml is:

<sec:http auto-config='true' pattern="/login.html*" security="none"/>
    <sec:http pattern="/a4j/**" security="none"/>
    <sec:http pattern="/css/**" security="none"/>
    <sec:http pattern="/img/**" security="none"/>
    <sec:http realm="Name goes here">
    <sec:form-login login-processing-url="/j_spring_security_check"
                    login-page="/login.html"
                    authentication-failure-url="/login.html?fail"
                    default-target-url="/main.html"
                    always-use-default-target="true"/>
    <sec:logout logout-url="/logout.html"/>
    <sec:intercept-url pattern="/**" access="ROLE_USER"/>
</sec:http>

and in login.xhtml:

<form id="frm-login" action="j_spring_security_check" method="post"> <label class="above">Username<h:inputText id="j_username" /></label> <rich:jQuery selector="#j_username" query="focus()"/><br/> <label class="above">Password<h:inputSecret id="j_password" /></label><br/> <h:commandButton id="submit" name="submit" type="submit" value="Login"> </h:commandButton> </form>

Before the upgrade this was fine. Using Firebug I have compared the generated HTML between the times where I see console errors and times I don't.

Bad Generated HTML when throwing console errors

Console errors

Good Generated HTML when working fine

I believe I have applied all necessary updates such as removing old jar files (including removal of redundant Facelets 1.1.14, view handler references), updating RF code, XHTML page code and namespaces as well as web.xml and faces-config.xml updates.

One thing I do know is that when I comment out the following config I do not receive the error. So somehow this is interfering with the loading of resources on this page.

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>INCLUDE</dispatcher>
</filter-mapping>

Any ideas how to resolve this? Apologies in advance if I have missed some vital information required in helping resolve this.

UPDATE 1: Images taken when loading page using Network tab on google chrome:

Bad enter image description here

Good enter image description here

UPDATE 2:

Good enter image description here enter image description here

Bad enter image description here

Solution

  • Ok I found it (with some helpful pointers from BallusC). After the upgrade I had to update the security config in applicationContext.xml as follows:

    <sec:http auto-config='true' pattern="/login.html*" security="none"/>
    <sec:http pattern="/a4j/**" security="none"/>
    <sec:http pattern="/css/**" security="none"/>
    <sec:http pattern="/img/**" security="none"/>
    <sec:http realm="name goes here">
    <sec:form-login login-processing-url="/j_spring_security_check"
                    login-page="/login.html"
                    authentication-failure-url="/login.html?fail"
                    default-target-url="/main.html"
                    always-use-default-target="true"/>
    <sec:logout logout-url="/logout.html"/>
    <sec:intercept-url pattern="/login.html*" access="ROLE_USER"/>
    <sec:intercept-url pattern="/a4j/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
    <sec:intercept-url pattern="/css/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
    <sec:intercept-url pattern="/img/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
</sec:http>

    The root cause of my issue above was having the following entry in applicationContext.xml:

    <sec:intercept-url pattern="/**" access="ROLE_USER"/>