Protected URLs leaking unprotected components of the webapge to unauthenticated users
问题 I believe implementing security for a JSF application through <login-config> + <security-constraint> + <security-role> & through use of <filter> are two different ways !? Are they ? I tried implementing security through the first method above(using <login-config> + <security-constraint> + <security-role> ) but found that my protected webpage that was using both protected & unprotected HTML components was delivered with unprotected resources even to the unauthenticated users. I need to protect