Just wanted to post a resolution in case anyone runs into the same problem. It turns out we have a global ISAPI filter called UrlScan.dll that gets called before our JK filter. UrlScan.dll is configured as a security precaution to reject any URL with a dot in the path that's not a file extension. There's an option AllowDotInPath=1 that allows the /a4j.res calls to pass through but it seems like ajax4jsf should allow that path to be configured somewhere. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4054059#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...