Preventing user from bypassing login

register your PhaseListener in the adf-setting.xml file




<?xml version="1.0" encoding="UTF-8" ?>
<adf-settings xmlns="http://xmlns.oracle.com/adf/settings">
  <adfc-controller-config xmlns="http://xmlns.oracle.com/adf/controller/config">
        <lifecycle>
            <phase-listener>
                <listener-id>DmsLsnr</listener-id>
                <class>com.syntax.view.source.bean.DmsPhaseListener</class>
            </phase-listener>
        </lifecycle>
    </adfc-controller-config>
</adf-settings>

Java Code

package com.syntax.view.source.bean;

import com.corelib.view.util.JSFUtils;


import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;

import javax.servlet.http.HttpSession;


import com.syntax.view.source.shared.ViewGlobals;

import oracle.adf.controller.v2.lifecycle.Lifecycle;
import oracle.adf.controller.v2.lifecycle.PagePhaseEvent;
import oracle.adf.controller.v2.lifecycle.PagePhaseListener;


import org.apache.myfaces.trinidad.render.ExtendedRenderKitService;
import org.apache.myfaces.trinidad.util.Service;


public class DmsPhaseListener implements PagePhaseListener {
    @Override
    public void afterPhase(PagePhaseEvent pagePhaseEvent) {
        //currentUserId.equals("USER_ID") ||
        if (pagePhaseEvent.getPhaseId() == Lifecycle.PREPARE_RENDER_ID) {
            String viewId = FacesContext.getCurrentInstance()
                                        .getViewRoot()
                                        .getViewId();
            System.out.println("Current view id is " + viewId);
            if (!viewId.contains("/login")) {
                String currentUserId = ViewGlobals.SSN_USER_ID;
                if (currentUserId == null ||  currentUserId.trim().length() == 0 ||
                    "0".equals(currentUserId)) {
                    System.out.println("Starting set user offline");
                    FacesContext fctx = FacesContext.getCurrentInstance();
                    ExternalContext ectx = fctx.getExternalContext();
                    String loginURL = JSFUtils.getPageURL("login");
                    JSFUtils.redirect(loginURL);
                }
            }
        }
    }

    @Override
    public void beforePhase(PagePhaseEvent pagePhaseEvent) {
        // TODO Implement this method
    }
}