JSF 页面安全保护问题

注册一个filter，然后在filter中检查web.xml <filter>
<filter-name>accessControl</filter-name>
<filter-class>
com.web.AccessControlFilter
</filter-class>
<init-param>
<param-name>loginPage</param-name>
<param-value>/index.jsf</param-value>
</init-param>
</filter>
        <filter-mapping>
<filter-name>accessControl</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping> <filter-mapping>
<filter-name>accessControl</filter-name>
<url-pattern>*.jsf</url-pattern>
</filter-mapping>AccessControlFilter public class AccessControlFilter extends HttpServlet implements Filter {

protected FilterConfig filterConfig; private String loginPage;
private static final String CONTENT_TYPE = "text/html;   charset=GBK"; public void init(FilterConfig config) throws ServletException {

this.filterConfig = config;
loginPage = config.getInitParameter("loginPage");
if (loginPage == null) {
throw new ServletException("loginPage   init   param   missing");
}


} public void doFilter(final ServletRequest req, final ServletResponse res,
FilterChain chain) throws IOException, ServletException { HttpServletRequest hreq = (HttpServletRequest) req;
HttpServletResponse hres = (HttpServletResponse) res;
hres.setContentType(CONTENT_TYPE);
hreq.setCharacterEncoding("GBK");
HttpSession session = hreq.getSession();
String uri = hreq.getRequestURI();
IdSessionBean idBean = (IdSessionBean) session.getAttribute(ATTR_ID_BEAN);


if (idBean == null) //尚未登录
{
String ctx=hreq.getContextPath();
PrintWriter out = hres.getWriter();
if (!uri.equals(ctx+"/index.jsf"))
out.println("<script   language='javascript'>alert('您还没有登录或很久未操作系统，请重新登录！');parent.parent.location.href='"+ctx+"/index.jsf';</script>");
else
chain.doFilter(req, res);
return;

}
else
{
//.........
chain.doFilter(req, res);
return;

} } public void destroy() {
this.filterConfig = null;
} public void setFilterConfig(final FilterConfig filterConfig) {
this.filterConfig = filterConfig;
}}