是的，如果您只想阻止对直接页面的访问，那可能是不使用自定义安全包之类的最佳方法 - 否则，如果您只是想确保页面正确呈现。实际上，您可以将您的 faces servlet 映射更改为 .xhtml，这意味着当人们访问页面时您的源代码不会被公开。
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.faces</url-pattern>
</servlet-mapping>
如果您想执行更复杂的重写规则以实际锁定页面，您可以考虑使用自定义重写处理器并实现处理器接口。
http://ocpsoft.com/docs/prettyfaces/3.3.0/en-US/html_single/#inbound_rewriting.options
自定义处理器可以访问 HttpServletRequest 和 HttpServletResponse 并在入站和出站重写时调用：您可以使用此接口执行更复杂的操作：
/**
* Perform a rewrite operation on a given URL, utilizing any necessary information from the given {@link RewriteRule}
* configuration object from which the processor was invoked.
*
* @author Lincoln Baxter, III <lincoln@ocpsoft.com>
*/
public interface Processor
{
/**
* Process an inbound URL Rewrite request. This takes place when the request first comes in to the server and passes
* through {@link RewriteFilter}
*/
String processInbound(HttpServletRequest request, HttpServletResponse response, RewriteRule rule, String url);
/**
* Process an outbound URL Rewrite request. This takes place when a URL is passed in to
* {@link HttpServletResponse#encodeRedirectURL(String)}, and since most frameworks ensure the call to
* 'encodeRedirectUrl()' occurs automatically, can be assumed to occur whenever a URL would be rendered to HTML
* output.
*/
String processOutbound(HttpServletRequest request, HttpServletResponse response, RewriteRule rule, String url);
}
否则，您正在做的事情将起作用，直到 OCPSoft Rewrite https://github.com/ocpsoft/rewrite（谁也在 PrettyFaces 后面）发布，在这种情况下，您可以使用简单的入站重写规则轻松完成此操作：
package com.example;
public class ExampleConfigurationProvider extends HttpConfigurationProvider
{
@Override
public int priority()
{
return 10;
}
@Override
public Configuration getConfiguration(final ServletContext context)
{
return ConfigurationBuilder.begin()
.defineRule()
.when(Direction.isInbound().and(DispatchType.isRequest()).and(Path.matches(".*\\.xhtml")).andNot(Path.matches(".*javax.faces.resource.*")))
.perform(SendStatus.code(404));
}
}
此重写规则将阻止对 .XHTML 文件的入站 HTTP 请求的访问，同时仍允许转发、错误或异步请求。它还将使 JSF2 资源 API 处于功能状态，如果您按照另一个答案中的建议使用 Java EE 安全约束，则情况并非如此。
希望这会有所帮助，林肯