Class FacesServlet
- All Implemented Interfaces:
javax.servlet.Servlet
FacesServlet is a servlet that manages the request processing lifecycle for web applications that are utilizing JavaServer Faces to construct the user interface.
If the application is running in a Servlet 3.0 (and beyond)
container, the runtime must provide an implementation of the ServletContainerInitializer
interface that declares
the following classes in its HandlesTypes
annotation.
ResourceDependencies
ResourceDependency
- javax.faces.bean.ManagedBean
FacesComponent
UIComponent
Converter
FacesConverter
ListenerFor
ListenersFor
FacesBehaviorRenderer
Renderer
FacesValidator
Validator
This servlet must automatically be mapped if it is
not explicitly mapped in web.xml
or
web-fragment.xml
and one or more of the following
conditions are true.
A
faces-config.xml
file is found inWEB-INF
A
faces-config.xml
file is found in theMETA-INF
directory of a jar in the application's classpath.A filename ending in
.faces-config.xml
is found in theMETA-INF
directory of a jar in the application's classpath.The
javax.faces.CONFIG_FILES
context param is declared inweb.xml
orweb-fragment.xml
.The
Set
of classes passed to theonStartup()
method of theServletContainerInitializer
implementation is not empty.
If the runtime determines that the servlet must be automatically
mapped, it must be mapped to the following
<url-pattern
> entries.
- /faces
- *.jsf
- *.faces
This class must be annotated with javax.servlet.annotation.MultipartConfig
.
This causes the Servlet container in which the JSF implementation is running
to correctly handle multipart form data.
Some security considerations relating to this class
The topic of web application security is a cross-cutting concern and every aspect of the specification address it. However, as with any framework, the application developer needs to pay careful attention to security. Please consider these topics among the rest of the security concerns for the application. This is by no means a complete list of security concerns, and is no substitute for a thorough application level security review.
Prefix mappings and the FacesServlet
If the FacesServlet
is mapped using a prefix
<url-pattern>
, such as
<url-pattern>/faces/*</url-pattern>
,
something must be done to prevent access to the view source without
its first being processed by the FacesServlet
. One
common approach is to apply a <security-constraint> to all
facelet files and flow definition files. Please see the
Deployment Descriptor chapter of the Java Servlet
Specification for more information the use of
<security-constraint>.
Allowable HTTP Methods
The JSF specification only requires the use of the GET and POST http methods. If your web application does not require any other http methods, such as PUT and DELETE, please consider restricting the allowable http methods using the <http-method> and <http-method-omission> elements. Please see the Security of the Java Servlet Specification for more information the use of these elements.
-
Field Summary
FieldsModifier and TypeFieldDescriptionstatic final String
Context initialization parameter name for a comma delimited list of context-relative resource paths (in addition to/WEB-INF/faces-config.xml
which is loaded automatically if it exists) containing JavaServer Faces configuration information.static final String
Context initialization parameter name for the lifecycle identifier of theLifecycle
instance to be utilized. -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionvoid
destroy()
Release all resources acquired at startup time.javax.servlet.ServletConfig
Return theServletConfig
instance for this servlet.Return information about this Servlet.void
init
(javax.servlet.ServletConfig servletConfig) Acquire the factory instances we will require.void
service
(javax.servlet.ServletRequest req, javax.servlet.ServletResponse resp) Process an incoming request, and create the corresponding response according to the following specification.
-
Field Details
-
CONFIG_FILES_ATTR
Context initialization parameter name for a comma delimited list of context-relative resource paths (in addition to
/WEB-INF/faces-config.xml
which is loaded automatically if it exists) containing JavaServer Faces configuration information.- See Also:
-
LIFECYCLE_ID_ATTR
Context initialization parameter name for the lifecycle identifier of the
Lifecycle
instance to be utilized.- See Also:
-
-
Constructor Details
-
FacesServlet
public FacesServlet()
-
-
Method Details
-
destroy
public void destroy()Release all resources acquired at startup time.
- Specified by:
destroy
in interfacejavax.servlet.Servlet
-
getServletConfig
public javax.servlet.ServletConfig getServletConfig()Return the
ServletConfig
instance for this servlet.- Specified by:
getServletConfig
in interfacejavax.servlet.Servlet
-
getServletInfo
Return information about this Servlet.
- Specified by:
getServletInfo
in interfacejavax.servlet.Servlet
-
init
public void init(javax.servlet.ServletConfig servletConfig) throws javax.servlet.ServletException Acquire the factory instances we will require.
- Specified by:
init
in interfacejavax.servlet.Servlet
- Throws:
javax.servlet.ServletException
- if, for any reason, the startup of this Faces application failed. This includes errors in the config file that is parsed before or during the processing of thisinit()
method.
-
service
public void service(javax.servlet.ServletRequest req, javax.servlet.ServletResponse resp) throws IOException, javax.servlet.ServletException Process an incoming request, and create the corresponding response according to the following specification.
If the
request
andresponse
arguments to this method are not instances ofHttpServletRequest
andHttpServletResponse
, respectively, the results of invoking this method are undefined.This method must respond to requests that contain the following strings by invoking the
sendError
method on the response argument (cast toHttpServletResponse
), passing the codeHttpServletResponse.SC_NOT_FOUND
as the argument./WEB-INF/ /WEB-INF /META-INF/ /META-INF
If none of the cases described above in the specification for this method apply to the servicing of this request, the following action must be taken to service the request.
Acquire a
FacesContext
instance for this request.Acquire the
ResourceHandler
for this request by callingApplication.getResourceHandler()
. CallResourceHandler.isResourceRequest(javax.faces.context.FacesContext)
. If this returnstrue
callResourceHandler.handleResourceRequest(javax.faces.context.FacesContext)
. If this returnsfalse
, callLifecycle.attachWindow(javax.faces.context.FacesContext)
followed byLifecycle.execute(javax.faces.context.FacesContext)
followed byLifecycle.render(javax.faces.context.FacesContext)
. If aFacesException
is thrown in either case, extract the cause from theFacesException
. If the cause isnull
extract the message from theFacesException
, put it inside of a newServletException
instance, and pass theFacesException
instance as the root cause, then rethrow theServletException
instance. If the cause is an instance ofServletException
, rethrow the cause. If the cause is an instance ofIOException
, rethrow the cause. Otherwise, create a newServletException
instance, passing the message from the cause, as the first argument, and the cause itself as the second argument.The implementation must make it so
FacesContext.release()
is called within a finally block as late as possible in the processing for the JSF related portion of this request.- Specified by:
service
in interfacejavax.servlet.Servlet
- Parameters:
req
- The servlet request we are processingresp
- The servlet response we are creating- Throws:
IOException
- if an input/output error occurs during processingjavax.servlet.ServletException
- if a servlet error occurs during processing
-