title: Writing an authorization filter for my web app(JSF 2.0)
body: <p>Following some advice, i decided to write my own authorization filter for my web app(I am not using container managed security so i have to do it this way).</p>
  
  <p>This is my first filter so i am a bit confused in how i should implement it.
  This is what i did so far:</p>
  
  <pre><code>package filters;
  
  import java.io.IOException;
  
  import javax.servlet.Filter;
  import javax.servlet.FilterChain;
  import javax.servlet.FilterConfig;
  import javax.servlet.ServletException;
  import javax.servlet.ServletRequest;
  import javax.servlet.ServletResponse;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import javax.servlet.http.HttpSession;
  
  import entities.Role;
  
  public class RestrictPageFilter implements Filter {
  
      FilterConfig fc;
  
      public void init(FilterConfig filterConfig) throws ServletException {
          // The easiest way to initialize the filter
          fc = filterConfig;
      }
  
      public void doFilter(ServletRequest request, ServletResponse response,
              FilterChain chain) throws IOException, ServletException {
  
          HttpServletRequest req = (HttpServletRequest) request;
          HttpServletResponse resp = (HttpServletResponse) response;
          HttpSession session = req.getSession(true);
          String pageRequested = req.getRequestURL().toString();
  
          Role currentUser = (Role) session.getAttribute("userRole");
  
          //Pages that are allowed with no need to login:
          //-faq.xhtml
          //-index.jsp
          //-login.xhtml
          //-main.xhtml
          //-registration.xhtml
  
          //NOW pages that are restricted depending on the type of user
          //buyoffer.xhtml(Only BUYER)
          //sellerpanel.xhtml(Only SELLER)
          //adminpanel.xhtml(Only ADMINISTRATOR)
  
          //HOW SHOULD I IMPLEMENT THAT??
          if(currentUser != null &amp;&amp; currentUser.getType().equals("BUYER")) {          
  
          }
          if(currentUser != null &amp;&amp; currentUser.getType().equals("SELLER")) {         
  
          }
          if(currentUser != null &amp;&amp; currentUser.getType().equals("ADMINISTRATOR")) {          
  
          }
  
  
      }
  
      public void destroy() {
          // Not needed
      }
  }
  </code></pre>
  
  <p>As you see i left comments there where i got stuck. Can someone give me a hand finishing this filter or give me some pseudo code tips how should i finish it? </p>
  
  <p>I saw some examples around the web, but none of them do different filtering depending on the user type.</p>
  
  <p>Ill appreciate your help :)</p>
  
  <p><b>Update</b></p>
  
  <p>I created an xml file to help me do the filtering(It is located inside WEB-INF/classes)</p>
  
  <pre><code>&lt;access&gt;
      &lt;buyer&gt;
          &lt;page&gt;buyoffer.xhtml&lt;/page&gt;
          &lt;page&gt;faq.xhtml&lt;/page&gt;
          &lt;page&gt;index.jsp&lt;/page&gt;
          &lt;page&gt;login.xhtml&lt;/page&gt;
          &lt;page&gt;main.xhtml&lt;/page&gt;
          &lt;page&gt;registrationSucceded.xhtml&lt;/page&gt;     
      &lt;/buyer&gt;
      &lt;seller&gt;
          &lt;page&gt;sellerpanel.xhtml&lt;/page&gt;
          &lt;page&gt;faq.xhtml&lt;/page&gt;
          &lt;page&gt;index.jsp&lt;/page&gt;
          &lt;page&gt;login.xhtml&lt;/page&gt;
          &lt;page&gt;main.xhtml&lt;/page&gt;
          &lt;page&gt;registrationSucceded.xhtml&lt;/page&gt;     
      &lt;/seller&gt;
      &lt;administrator&gt;
          &lt;page&gt;sellerpanel.xhtml&lt;/page&gt;
          &lt;page&gt;faq.xhtml&lt;/page&gt;
          &lt;page&gt;index.jsp&lt;/page&gt;
          &lt;page&gt;login.xhtml&lt;/page&gt;
          &lt;page&gt;main.xhtml&lt;/page&gt;
          &lt;page&gt;registrationSucceded.xhtml&lt;/page&gt;     
      &lt;/administrator&gt;
  &lt;/access&gt;
  
  &lt;!-- THE REGISTRATION PAGES SHOULD NOT BE ACCESSIBLE IF THE USER IS LOGGED IN --&gt;
  </code></pre>
  
  <p>I read the file from the init() method.()</p>
  
  <pre><code>public class RestrictPageFilter implements Filter {
  
      private FilterConfig fc;
  private InputStream in;
  
      public void init(FilterConfig filterConfig) throws ServletException {
          // The easiest way to initialize the filter
          fc = filterConfig;
          //Get the file that contains the allowed pages
          in = this.getClass().getResourceAsStream("/allowedpages.xml");
      }
  
      public void doFilter(ServletRequest request, ServletResponse response,
              FilterChain chain) throws IOException, ServletException {
  
          HttpServletRequest req = (HttpServletRequest) request;
          HttpServletResponse resp = (HttpServletResponse) response;
          HttpSession session = req.getSession(true);
          String pageRequested = req.getRequestURL().toString();
  
          //Get the value of the current logged user 
          Role currentUser = (Role) session.getAttribute("userRole");
          if (currentUser != null) {
  
          }
      }
  
      public void destroy() {
          // Not needed
      }
  }
  </code></pre>