[{"data":1,"prerenderedAt":262},["ShallowReactive",2],{"page-en-\u002Fblog\u002Fspring-security-primefaces-redirect-issue-fix":3,"related-en-\u002Fblog\u002Fspring-security-primefaces-redirect-issue-fix":241},{"id":4,"title":5,"body":6,"date":226,"description":227,"extension":228,"meta":229,"navigation":230,"path":231,"seo":232,"stem":233,"tags":234,"translation":239,"__hash__":240},"pages_en\u002Fen\u002Fblog\u002Fspring-security-primefaces-redirect-issue-fix.md","Fixing the Spring Security + PrimeFaces Redirect Issue",{"type":7,"value":8,"toc":224},"minimark",[9,21,39,128,131,136,144,149,155,164,167,177,180,188,191,197,200,206,220],[10,11,12,13,20],"p",{},"Spring Security is a well-established name in the Java EE world and — in my opinion — a godsend for securing Java applications. You can find detailed info ",[14,15,19],"a",{"href":16,"rel":17},"http:\u002F\u002Fprojects.spring.io\u002Fspring-security\u002F",[18],"nofollow","on its site",".",[10,22,23,24,29,30,38],{},"PrimeFaces is also the most successful component library recognized in the JSF world; again, ",[14,25,28],{"href":26,"rel":27},"http:\u002F\u002Fwww.primefaces.org",[18],"detailed info is at this address",".\nIn my project built on JSF 2.2 + Spring 4 + Hibernate 4 + PrimeFaces 5, I noticed that after a successful login the page didn't navigate to the URL it was supposed to. When I examined the Spring Security logs, there was no problem at all — it was sending the request to the URL I specified in the configuration via \"",[31,32,33],"strong",{},[14,34,37],{"href":35,"rel":36},"https:\u002F\u002Ftomcat.apache.org\u002Ftomcat-5.5-doc\u002Fservletapi\u002Fjavax\u002Fservlet\u002Fhttp\u002FHttpServletResponse.html#sendRedirect(java.lang.String)",[18],"sendRedirect","\". In a place where everything was this perfect, of course I went nuts trying to figure out how it could not work 🙂\nThe Spring Security log looks like this. It redirected from the \u002Flogin page to \u002Fpages\u002Fhome just as I wanted.",[40,41,46],"pre",{"className":42,"code":43,"language":44,"meta":45,"style":45},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","[DEBUG] ..access.intercept.FilterSecurityInterceptor – Authorization successful\n[DEBUG] ..security.web.FilterChainProxy            – \u002Fpages\u002Fhome.xhtml reached end of additional filter chain; proceeding with original chain\n[DEBUG] ..web.access.ExceptionTranslationFilter    – Chain processed normally\n[DEBUG] ..web.context.SecurityContextPersistenceFilter – SecurityContextHolder now cleared, as request processing completed\n","bash","",[47,48,49,68,104,116],"code",{"__ignoreMap":45},[50,51,54,58,62,65],"span",{"class":52,"line":53},"line",1,[50,55,57],{"class":56},"sMK4o","[",[50,59,61],{"class":60},"sTEyZ","DEBUG",[50,63,64],{"class":56},"]",[50,66,67],{"class":60}," ..access.intercept.FilterSecurityInterceptor – Authorization successful\n",[50,69,71,73,75,77,80,84,87,90,94,98,101],{"class":52,"line":70},2,[50,72,57],{"class":56},[50,74,61],{"class":60},[50,76,64],{"class":56},[50,78,79],{"class":60}," ..security.web.FilterChainProxy            – \u002Fpages\u002Fhome.xhtml reached ",[50,81,83],{"class":82},"s7zQu","end",[50,85,86],{"class":60}," of additional filter chain",[50,88,89],{"class":56},";",[50,91,93],{"class":92},"sBMFI"," proceeding",[50,95,97],{"class":96},"sfazB"," with",[50,99,100],{"class":96}," original",[50,102,103],{"class":96}," chain\n",[50,105,107,109,111,113],{"class":52,"line":106},3,[50,108,57],{"class":56},[50,110,61],{"class":60},[50,112,64],{"class":56},[50,114,115],{"class":60}," ..web.access.ExceptionTranslationFilter    – Chain processed normally\n",[50,117,119,121,123,125],{"class":52,"line":118},4,[50,120,57],{"class":56},[50,122,61],{"class":60},[50,124,64],{"class":56},[50,126,127],{"class":60}," ..web.context.SecurityContextPersistenceFilter – SecurityContextHolder now cleared, as request processing completed\n",[10,129,130],{},"I started digging deeper — first I watched the request\u002Fresponse flow in the browser.",[10,132,133],{},[31,134,135],{},"Request:",[40,137,142],{"className":138,"code":140,"language":141,"meta":45},[139],"language-text","javax.faces.partial.ajax:true\njavax.faces.source:loginButton\njavax.faces.partial.execute:loginForm\njavax.faces.partial.render:loginForm\nloginButton:loginButton\nloginForm:loginForm\nusername:test\npassword:123456\n_csrf:49756ca7-38fd-4777-bea8-58fcfe7deb73\njavax.faces.ViewState:-3601270081246135757:6121484162719565648\n","text",[47,143,140],{"__ignoreMap":45},[10,145,146],{},[31,147,148],{},"Response:",[40,150,153],{"className":151,"code":152,"language":141,"meta":45},[139],"xml version='1.0' encoding='UTF-8'?\n-6140875972550706628:-2367790204853062502\n",[47,154,152],{"__ignoreMap":45},[10,156,157,158,163],{},"When I saw these, of course ",[14,159,162],{"href":160,"rel":161},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=gbnhydOczwI",[18],"I said \"Oh my God\""," — why? 🙂",[10,165,166],{},"Because there's no \"redirect-url\" in the response! There's only an \"update\"! So we made a mistake in the Ajax part (javax.faces.partial.ajax:true), and there are two ways around it;",[168,169,170,174],"ol",{},[171,172,173],"li",{},"Setting ajax=\"false\" in the PrimeFaces commandButton attributes",[171,175,176],{},"Using a classic JSF button instead of the PrimeFaces button",[10,178,179],{},"The button I was using",[40,181,184],{"className":182,"code":45,"language":183,"meta":45,"style":45},"language-xml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","xml",[47,185,186],{"__ignoreMap":45},[50,187],{"class":52,"line":53},[10,189,190],{},"Option 1",[40,192,193],{"className":182,"code":45,"language":183,"meta":45,"style":45},[47,194,195],{"__ignoreMap":45},[50,196],{"class":52,"line":53},[10,198,199],{},"Option 2 (you can't benefit from the PrimeFaces button's CSS here — you'd have to add it manually)",[40,201,202],{"className":182,"code":45,"language":183,"meta":45,"style":45},[47,203,204],{"__ignoreMap":45},[50,205],{"class":52,"line":53},[10,207,208,209,214,215],{},"In the end it looks this simple, but I couldn't figure it out without watching the traffic in the browser. By the way, it's become nearly standard in all browsers — it's usually called \"Developer Tools\" and you can open it with F12; I wanted to mention it in case some don't know.\nBesides these, we could have done this by overriding the place where Spring Security calls \"sendRedirect\", but that would be more costly. How to do it was given in ",[14,210,213],{"href":211,"rel":212},"http:\u002F\u002Fstackoverflow.com\u002Fquestions\u002F9305144\u002Fusing-jsf-2-0-facelets-is-there-a-way-to-attach-a-global-listener-to-all-ajax\u002F9311920#9311920",[18],"this answer"," by the master BalusC 🙂\nFor the root of the problem, ",[14,216,219],{"href":217,"rel":218},"http:\u002F\u002Fstackoverflow.com\u002Fquestions\u002F10954319\u002Fjsf-2-response-sendredirect-is-not-working",[18],"see this resource.",[221,222,223],"style",{},"html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":45,"searchDepth":70,"depth":70,"links":225},[],"2015-05-15","The fix for the redirect problem that appears when using Spring Security with PrimeFaces.","md",{},true,"\u002Fen\u002Fblog\u002Fspring-security-primefaces-redirect-issue-fix",{"title":5,"description":227},"en\u002Fblog\u002Fspring-security-primefaces-redirect-issue-fix",[235,236,237,238],"java","jsf","primefaces","spring","\u002Fblog\u002Fspring-security-primefaces-redirect-issue-fix","PgYxzMV0jD2UoMI45dVjfY-PRcUUSADD7TE6TzCVNTg",[242,249,256],{"path":243,"title":244,"description":245,"date":246,"tags":247},"\u002Fen\u002Fblog\u002Fjava-21-features","What's New in Java 21: Virtual Threads, Records and Pattern Matching","The Java 21 LTS features that change day-to-day code the most — virtual threads, records, switch pattern matching, record patterns, sealed classes and sequenced collections.","2026-11-01",[235,248],"guide",{"path":250,"title":251,"description":252,"date":253,"tags":254},"\u002Fen\u002Fblog\u002Finstall-java-on-centos-7-rhel-7","Installing Java on CentOS 7 & Red Hat Enterprise Linux 7","Installing Java 11 (OpenJDK) on CentOS 7 and RHEL 7 with yum, plus picking an alternative version — a short step-by-step guide.","2019-11-08",[235,255],"linux",{"path":257,"title":258,"description":259,"date":260,"tags":261},"\u002Fen\u002Fblog\u002Fjava-11-12-13-and-beyond","Java 11-12-13 and Beyond","What's new in Java 11 and later: the new release cadence and the standout features.","2019-02-13",[235],1793491381197]