In my application web.xml has security configuration for free content
{quote}
<security-constraint>
<web-resource-collection>
<web-resource-name>Open Content</web-resource-name>
<!-- Allow subscribe -->
<url-pattern>/scripts/*</url-pattern>
<url-pattern>/css/*</url-pattern>
<url-pattern>/javax.faces.resource/*</url-pattern>
</web-resource-collection>
</security-constraint>
{quote}
It works well but looking into deep i see that all free content like
icefaces.ace:themes/sam/images/ui-icons_222222_256x240.png
passes through a unnecessary session verification and cascade of resource handlers

I know. Short answer is "it is ok, jsf core, by design, change your web.xml".
But maybe it can be done better than standard offers?

Stack below is for icefaces.ace:themes/sam/images/ui-icons_222222_256x240.png resource. No one expects such overhead. It fails on performance tests.

{quote}
SessionTimeoutMonitor.isSessionAwareResourceRequest(FacesContext) line: 44
SessionTimeoutMonitor(SessionAwareResourceHandlerWrapper).isResourceRequest(FacesContext) line: 32
CharacterEncodingHandler.isResourceRequest(FacesContext) line: 73
AuxUploadResourceHandler(ResourceHandlerWrapper).isResourceRequest(FacesContext) line: 65
ResourceHandlerImpl.getLocalePrefixForLocateResource(FacesContext) line: 691
ResourceHandlerImpl.createResource(String, String, String) line: 141
PrimeResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
FileEntryResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
RichTextEntryResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
RichTextEntryResourceHandler.createResource(String, String, String) line: 94
GMapResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
GMapResourceHandler.createResource(String, String, String) line: 80
ThemeSymbolicResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
ThemeSymbolicResourceHandler.createResource(String, String, String) line: 87
AceSymbolicResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
AceSymbolicResourceHandler.createResource(String, String, String) line: 54
QRCodeResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
VersioningResourceHandler.createResource(String, String, String) line: 50
CoalescingResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
CoalescingResourceHandler.createResource(String, String, String) line: 105
ICEpushResourceHandler$ICEpushResourceHandlerImpl(ResourceHandlerWrapper).createResource(String, String, String) line: 47
ICEpushResourceHandler.createResource(String, String, String) line: 115
DynamicResourceDispatcher(ResourceHandlerWrapper).createResource(String, String, String) line: 47
ResourceRegistry(ResourceHandlerWrapper).createResource(String, String, String) line: 47
WindowScopeManager(ResourceHandlerWrapper).createResource(String, String, String) line: 47
NavigationNotifierHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
NavigationNotifierHandler.createResource(String, String, String) line: 72
BridgeSymbolicResourceHandler(ResourceHandlerWrapper).createResource(String, String, String) line: 47
BridgeSymbolicResourceHandler.createResource(String, String, String) line: 48
BridgeSymbolicResourceHandler.createResource(String, String) line: 37
ClientDescriptorSetup(ResourceHandlerWrapper).createResource(String, String) line: 41
SessionTimeoutMonitor(ResourceHandlerWrapper).createResource(String, String) line: 41
CharacterEncodingHandler(ResourceHandlerWrapper).createResource(String, String) line: 41
AuxUploadResourceHandler(ResourceHandlerWrapper).createResource(String, String) line: 41
ResourceResolver.getValue(ELContext, Object, Object) line: 141
FacesCompositeELResolver(CompositeELResolver).getValue(ELContext, Object, Object) line: 67
FacesCompositeELResolver.getValue(ELContext, Object, Object) line: 179
{quote}