Secure your Adf Application || Oracle ADF

Hi
Oracle ADF Security, one of the most important issues faces any Developer working in Fusion Application, How to secure your Application to prevent illegal Access escaping from your security Rules ..
From my point of view, 2 solutions Exists ,

• using Standard ADF Security which implements Servlets to take Responsibility of Security Rule, More.
•  Customize your Servlet to make same Rules and take care of Automatic Redirect in case of illegal access.

today, i will Develop 2nd solution to apply security Rules matching with my Customized Security Rules ..
Steps ..
    1- in Web.xml file, include your servlet to be used as a security filter.
<filter>
        <filter-name>ServletFilter</filter-name>
        <filter-class>Servlets.ServletFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>ServletFilter</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
    </filter-mapping>
    <filter-mapping>
        <filter-name>ServletFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>ERROR</dispatcher>
    </filter-mapping>
   2- create Security in your Servlets.ServletFilter directory ..
package Servlets;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class ServletFilter implements Filter {
    private FilterConfig _filterConfig = null;

    public void init(FilterConfig filterConfig) throws ServletException {
        _filterConfig = filterConfig;
    }

    public void destroy() {
        _filterConfig = null;
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
                                                                                                     ServletException {
        HttpServletRequest MyRequest = (HttpServletRequest)request;
        HttpServletResponse MyResponse = (HttpServletResponse)response;
        HttpSession session = MyRequest.getSession();
        String a = (String)session.getAttribute(“a”);
        /*System.out.println(“Filter Works .. “);
        System.out.println(MyRequest.getRequestURI().toString());*/

        if (MyRequest.getRequestURI().toString().endsWith(“/Pages/login.jsf”) ||
            MyRequest.getRequestURI().toString().endsWith(“/Pages/login”) ||
            MyRequest.getRequestURI().toString().endsWith(“.jpg”) ||
            MyRequest.getRequestURI().toString().endsWith(“.css”) ||
            MyRequest.getRequestURI().toString().endsWith(“.bmp”) ||
            MyRequest.getRequestURI().toString().endsWith(“.gif”) ||
            MyRequest.getRequestURI().toString().endsWith(“.png”) ||
            MyRequest.getRequestURI().toString().endsWith(“.swf”) ||
            MyRequest.getRequestURI().toString().endsWith(“.js”) || a != null) {

            chain.doFilter(MyRequest, MyResponse);
            return;
        } else {
            MyResponse.sendRedirect(“/Interface/faces/Pages/login.jsf”);
            return;
        }
    }
    // Wael Abdeen
}

Note, as you see in above Example, i avoid image extensions as well as swf & js files , to make servlet exclude them from security Rule, otherwise, you will get JSF page without them !!