Redirect JSF ajax request to an URL with request parameters in a servlet filter

Question

I am using JSF2.2 and have servlet filter configured. Part of the code in Filter that work:

HttpServletResponse response = (HttpServletResponse) resp;
if (userSession == null) {

    redirectURLRegular = response.encodeRedirectURL("../login.xhtml?param1=noSession");
    redirectURLAjax = response.encodeRedirectURL(request.getContextPath()
                + "/faces/login.xhtml?param1=noSession");

else{
    chain.doFilter(req, resp);
    return;

if (isAJAXRequest(request)) {

        StringBuilder sb = new StringBuilder();
        sb.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>
            <partial-response><redirect url=\"").append(redirectURLAjax)
                .append("\"></redirect></partial-response>");
        response.setHeader("Cache-Control", "no-cache");
        response.setCharacterEncoding("UTF-8");
        response.setContentType("text/xml");

        PrintWriter pw = response.getWriter();
        pw.println(sb.toString());
        pw.flush();

    } else { 
        response.sendRedirect(redirectURLRegular);
    }

If session is null redirect - both regular and AJAX happens. In next page (login.xhtml, requestScoped) I can get parameter value (param1) in bean via

@ManagedProperty("#{param.param1}")
private String param1;

If I add second param "../login.xhtml?param1=noSession&param2=val2" - regular requests work (redirect happens and see both params) but AJAX request dose not work(no redirect, nothing happens). Here is Firebug report:

XML Parsing Error: not well-formed Location: moz-nullprincipal:{4584d37a-e799-43db-8379-b0451edca95c} Line Number 1, Column 120:

..."/admin/faces/login.xhtml?param1=noSession&param2=val2"></redirect></partial-r...
...-------------------------------------------------^

How is this caused and how can we set multiple parameters in filter for AJAX calls?

Answer 1

The & is a special character in XML representing the start of an entity like &, <, etc. The XML parser is implicitly looking for the name (amp, lt, etc) and the ending ;. However, you wasn't using it as such and hence the webbrowser's XML parser felt over it when it unexpectedly encountered an =, making it non-well-formed XML.

You need to escape the XML special character & into the entity &.

redirectURLAjax = response.encodeRedirectURL(request.getContextPath()
            + "/faces/login.xhtml?param1=noSession&param2=val2");