Enterprise Client Community

I want to intercept a call of an managed bean action method to do some work like security checks etc. before the method is called.

I know in JSF exists ActionListeners (called before the action phase is invoked) or PhaseListeners registered in the faces-config.cfg.

Maybe anyone has experience implementing an Action-Method-Interceptor.

It would be also a nice feature to improve CaptainCASA with a Framework-Action-Interceptor interface like:

IActionInterceptor {

peformAction(Object calledManagedBean, Method method, Object[] params …) ;
//do some reflection etc.
}

So i could do some security checks etc. before i call a action method of a managed bean

I have done some research how to implement a JSF Action-Method-Interceptor.
In the JSF specification you can provide a JSF action listener implementation in the faces-config.cfg:

<application>
<action-listener>
com.lip.road.frontend.core.actionlistener.ActionMethodInterceptor
</action-listener>
</application>

This instance is create on application startup an can be accessed over the FacesContext:
event.getFacesContext().getApplication().getActionListener();

I thought this action listener must be invoked for every action request and before the action method in the backing bean was invoked.

The code in my ActionListener class is never invoked and I don't know if there is any configuration problem or maybe I'm wrong with the action-listener behavior of JSF or CaptainCASA.

Really, what I want is to intercept every backing bean method invocation in order to check some issues about security and so on.

If you know another way to do it please let me know. I have also tested to intercept the action method with the BEANMETHODINVOKER -Component. This doesn’t work because I want to retrieve in the action-listener method the called component of the ManagedBean and not the BEANMETHODINVOKER-Component:

if(! (event.getSource() instanceof javax.faces.component.UICommand)) {
(javax.faces.component.UICommand) event.getSource();
String expFullAction = comando.getAction().getExpressionString();
…

@see also:
http://blogs.sun.com/enterprisetechtips/entry/improving_jsf_security_configuration_with

CaptainCasa now offer an interception way, based on your input. It is part of 20090126 for test purpose.

Björn

i tested the action interceptor. works good for my purposes. good improvement of the framework! but i still have some questions:

i implemented the interceptor interface in our own dispatcher:

public class Dispatcher extends WorkpageDispatcher implements IMethodBindingListener {

...
public Dispatcher() {
...
HttpSessionAccess.setMethodBindingListener(this);
}

reactOnListenerInvokeAfter() {
...
}

reactOnListenerInvokeBefore() {
...
}

1. Every user has his own „dispatcher“ because the ManagedBean is registered in the "session" scope of JSF. The „dispatcher“ calls HttpSessionAccess.setMethodBindingListener(this) on instantiation (see ctor). Is the „dispatcher“ the right place to register the MethodBindingListener? Has every user his own MethodBindingListener in the http session scope?