结合一次性“供应”和“供应”。使用 JSF 进行处理？
首先，我要承认这是我的第一个 Web 应用程序，也是我第一次使用 JSF，因此我可能做出了一些糟糕的设计决策。
这就是我正在尝试做的事情： 我有一个使用 JSF 2.0 的 Web 应用程序，可以通过 Facebook 画布访问它。该网络应用程序允许用户查看/操作传感器读数数据库中的数据。 Facebook 用户第一次访问我的应用程序时，我要求用户输入数据库的登录凭据，然后将用户发送到主页。此后，用户应该始终直接进入主页，因为我将用户的 FB ID 与数据库用户配置文件关联起来。
当前实施： 我有 Facebook 画布 URL 到 servlet。该servlet 检查Facebook 传递的signed_request 参数以获取用户ID，然后在数据库中查找用户是否已完成配置过程。如果用户这样做了，他将被重定向到应用程序主页。
问题： 我执行这些检查的大部分逻辑当前都存在于托管 bean（会话范围）内。为了在 servlet 中使用该 bean，我手动实例化该 bean 并将其添加到会话中，因为 JSF 框架还没有机会创建它。随着我的系统变得越来越复杂，由于各种 bean 之间的依赖关系，这导致了问题。而且，这似乎是解决问题的一种糟糕的方法。
解决方案？从我的网络搜索来看，听起来可能有多种方法可以做到这一点。一种方法是将画布设置为 JSF 登录页面，其中托管 Bean 将获取signed_request 参数并验证用户是否已完成配置步骤。从那里，bean 将转发到正确的页面。另一种可能性可能是有一个热切的 bean 来做同样的事情，但这似乎是“错误的”。
解决此问题并遵守“正确的”JSF 范例的最佳方法是什么？
提前致谢！
Let me preface this by admitting that this is my first webapp and first experience with JSF, so I've probably made some poor design decisions.
Here's what I'm trying to do:
I have a webapp using JSF 2.0, which is accessible through a Facebook canvas. This webapp allows a user to view/manipulate data from a database of sensor readings. On the very first time the Facebook user accesses my app, I ask the user to enter login credentials for the database, then send the user to the home page. Thereafter, the user should always go straight to the home page, since I associate the user's FB id with the database user profile.
Current implementation:
I have the Facebook canvas URL going to a servlet. This servlet checks the signed_request parameter passed by Facebook to get the user ID, and then looks in the database to see if the user has already completed the provisioning process. If the user has done so, he is redirected to the application home page.
The problem:
Most of my logic to do these checks currently exists within a managed bean (session-scoped). To use the bean within the servlet, I'm manually instantiating the bean and adding it to the session, since the JSF framework hasn't had a chance to create it yet. As my system is getting more complicated, this is causing problems due to dependencies between the various beans. Also, it seems like a generally bad approach to the problem.
Solutions? From my web searching, it sounds like there might be several ways to do this. One way would be to set the canvas to a JSF landing page, where a managed bean would grab the signed_request parameter and validate that the user has completed the provisioning step. From there, the bean would forward to the proper page. Another possibility might be to have an eager bean that does the same thing, but this seems "wrong".
What's the best way to resolve this and adhere to "proper" JSF paradigms?
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
有多种不同的方法可以处理这个问题。 JSF 登陆页面是一种想法，而 eager bean 是处理此问题的一些方法。
如果您忽略了与 Facebook 集成的事实，那么最终您是在尝试解决身份验证和授权问题。 Facebook 正在处理您的身份验证，并告诉您的 Web 应用程序用户的身份是什么，您的 Web 应用程序的工作是在整个会话中记住该人的身份，并授权此人访问所请求的内容页。
我之前已经实现过它，我让所有托管 bean 都扩展了一个 BaseBean 类，该类在创建和初始化时检查是否存在包含用户标识信息的特定 SessionScoped bean。如果这个 bean 不存在或者没有被授权访问这个 bean，那么我会重定向。这种方法的问题在于它只授权使用托管 bean，而不授权页面。
我采用的另一种方法是利用 servlet 过滤器，该过滤器本质上会检查每个页面请求并查找包含当前经过身份验证的用户的会话范围 bean。如果没有找到，那么我将查找特定的请求参数并进行身份验证并创建会话 bean，如果不存在，则会重定向到未经授权的页面。
这种方法效果很好，直到我意识到 Java Web 应用程序的身份验证和授权是一个很好理解且几乎普遍存在的问题。经过一些观察和研究，我发现像 Spring Security 3 这样的安全框架确实可以集成到 JSF 中，并处理几乎所有复杂的身份验证和授权的复杂性。您可以非常轻松地为 Spring Security 集成自定义 Facebook 身份验证处理程序，并通过用户角色控制对单个页面级别的访问，所有这些都来自 XML 配置。如果您有时间学习新东西，这是非常值得研究的。
There are a number of different ways that this can be handled. The JSF landing page is one idea and the eager bean are some ways that this can be handled.
If you ignore the fact that you are integrating with Facebook then ultimately you are trying to solve an authentication and authorization problem. Facebook is handling your authentication, and telling your web application what the identity of a user is, and it is your web app's job to remember that person's identity throughout the session, and authorize this person to visit the requested page.
I have implemented it before where I had all of my managed beans extend a BaseBean class that on creation and initialization checked for the existence of a specific SessionScoped bean that contained the user identitification information. If this bean did not exist or was not authorized to access this bean then I would redirect. The problem with this approach was that it authorized only the use of managed beans, and not pages.
Another approach I had was to utilize a servlet filter that would essentially check every page request and look for the session scoped bean that contained the currently authenticated user. If this wasn't found then I would look for the specific request parameters and authenticate and create the session bean, and if that didn't exist would redirect to an Unauthorized page.
This approach worked well until I realized that Authentication and Authorization of Java web applications is a well understood and near universal problem. After a little bit of looking and research I discovered that security frameworks like Spring Security 3 can indeed be integrated into JSF and handle nearly all of the complexity of complex authentication and authorization. You could very easily integrate a custom Facebook authentication handler for Spring Security and control access by user role to the individual page level, all from XML configuration. It is highly worth looking into if you have the time to learn something new.