Java : Intercept all requests before they go to login authentication

Question

我想首先拦截过滤器中的所有请求。我还有一个应用于所有请求的登录身份验证，即过滤器和登录身份验证都配置为拦截所有请求。

但是，当发出任何请求时，它首先会被尝试呈现登录页面的登录身份验证拦截。我希望请求首先被过滤器拦截，然后由登录身份验证拦截。

以下是相关代码。

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    id="WebApp_ID" version="2.5">
    <display-name>Tango</display-name>

    <filter>
        <filter-name>SalsaValidationFilter</filter-name>
        <filter-class>net.semandex.salsa.validationFilters.SalsaValidationFilter</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>SalsaValidationFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <!-- <servlet-name>SalsaValidationServlet</servlet-name> -->
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

    <session-config>
        <session-timeout>20</session-timeout>
    </session-config>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Login page images</web-resource-name>
            <url-pattern>/images/salsadb-logo2.png</url-pattern>
            <url-pattern>/images/salsa-icon.png</url-pattern>
            <url-pattern>/images/shadow_box.png</url-pattern>
            <url-pattern>/images/header.png</url-pattern>
            <url-pattern>/images/bg.png</url-pattern>
            <url-pattern>/css/splash.css</url-pattern>
            <url-pattern>/WEB-INF/licenseValidation.html</url-pattern>
            <url-pattern>/auth/licenseValidation.html</url-pattern>
        </web-resource-collection>
    </security-constraint>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>The entire webapp</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>SalsaUser</role-name>
        </auth-constraint>
    </security-constraint>

    <security-role>
        <role-name>SalsaUser</role-name>
    </security-role>

    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
          <form-login-page>/auth/login.jsp</form-login-page>
          <form-error-page>/auth/loginError.jsp</form-error-page>
        </form-login-config>

        <realm-name>mongo_login</realm-name>
    </login-config>
</web-app>

更多细节: 这就是发生的事件的流程。假设发出了对主页的请求，它首先由尝试呈现登录页面的登录身份验证处理。登录页面有一些图像和CSS。因此提出了对这些图像的请求。这些请求被过滤器拦截。

Filter

public class SalsaValidationFilter implements Filter {

    private ServletContext context;

    public void init(FilterConfig fConfig) throws ServletException {
        this.context = fConfig.getServletContext();
        this.context.log("SalsaValidationFilter initialized");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;

        String uri = req.getRequestURI();
        this.context.log("Requested Resource::"+uri);

        HttpSession session = req.getSession(false);

        boolean licenseValid = false;
        if( !licenseValid && !uri.endsWith("licenseValidation.html") ){
            this.context.log("NO valid license was found");
            // pass the request along the filter chain
            res.sendRedirect( req.getContextPath() +  "/auth/licenseValidation.html");
            return;
        }
        //else{
            chain.doFilter(req, res);
        //}
    }

    public void destroy() {
        //close any resources here
    }

}

知道如何确保过滤器首先拦截请求吗？

Answer 1

Any idea how I can ensure that filter intercepts the requests first?

您需要安装一种特殊的过滤器，称为ServerAuthModule，也称为SAM。

这个特殊的过滤器来自 Java EE 的 JASPIC 规范，在调用任何其他过滤器或 servlet 之前调用，并且它是您应该在 Java EE 中执行与安全性相关的操作的专用位置。