Do some check before every page is loaded and redirect to another page

Question

I need to do some checks before every page is loaded to see if there's a need to redirect the user to another page (for security reasons).

When I was using JSF 2.0 I used a phase listener to do this job. Now that I'm using JSF 2.2 and all my beans are not JSF beans anymore, but CDI beans, I think I'm offered better choices to do this (or not?).

I've heard of the viewAction event, but I wouldn't like to be repeating metadata on every page (only if there's no other option).

So what's the best approach to implement this scenario in JSF 2.2 with CDI?

UPDATE (after @skuntsel suggestion)

This is the filter that I'm using for now. I would like to use it only after authentication to simplify its code. By the way, if you can see any mistake in it, I would appreciate if you told me.

@WebFilter("/*")
public class SolicitacoesFilter implements Filter
{
    // I can't just use @Inject private User _user, because it needs to be initialized
    // only when the user is authenticated. Otherwise an exception is thrown. If this
    // filter was called only after the authentication I could use the mentioned code.
    private User _user;

    @Inject
    private Instance<User> _userGetter;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException
    {
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
    {
        if (initializeUser(request))
        {
            if (_user.isProvisoryPassword())
            {
                // Redirect to another page...
                return;
            }
            if (_user.getStatus() != Status.ACTIVE)
            {
                // Redirect to another page...
                return;
            }
        }
        chain.doFilter(request, response);
    }

    @Override
    public void destroy()
    {
    }

    private boolean initializeUser(ServletRequest request)
    {
        boolean userAuthenticated = ((HttpServletRequest) request).getUserPrincipal() != null;
        if (userAuthenticated)
        {
            if (_user == null)
            {
                _user = _userGetter.get();
            }
        }
        else
        {
            _user = null;
        }
        return _user != null;
    }
}

Answer 1

Ok, what are the purposes of your redirection need ?

• If it's about checking session User for authentification purposes, use filter:

Let's assume there is login form at : http://www.domain.com/login.jsf. Once the user fires connect button, we want to redirect him to http://www.domain.com/member/welcome.jsf, and avoid other people not to access the member/welcome.jsf domain, I mean all the pages which are in http://www.domain.com/member/....

Here a simple design:

@WebFilter("/member/*")  
public class SecurityCheck implements Filter {

public void init(FilterConfig filterConfig) throws ServletException {

}

@Override
public void doFilter(ServletRequest req, ServletResponse res,
    FilterChain chain) throws ServletException, IOException {

  HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    HttpSession session = request.getSession();

    if (session == null || session.getAttribute("User") == null) {
        response.sendRedirect(request.getContextPath() + "/index.xhtml"); // No logged-in user found, so redirect to login page.
    } else {
        chain.doFilter(req, res); // Logged-in user found, so just continue request.
    }

}

@Override
public void destroy() {
// Cleanup global variables if necessary.
}

• Other case, use:

  <h:link></h:link>,or <h:commandLink></h:commandLink> // Checking in the managed Beans method
  

• You can also xml file, for redirection.