com.cdk.core.security.api

Class OauthTokenValidationInterceptor

java.lang.Object

com.cdk.core.security.api.OauthTokenValidationInterceptor

All Implemented Interfaces:

org.springframework.web.servlet.HandlerInterceptor

@Component
public class OauthTokenValidationInterceptor
extends Object
implements org.springframework.web.servlet.HandlerInterceptor

Interceptor that validates all the requests to the REST apis to check if the valid access token is present in the header. all request HandlerInterceptor and AbstractAuthenticationProcessingFilter may be used for the same purpose but normally in a Spring based project authentication/authorization is handled by Spring Security (AbstractAuthenticationProcessingFilter). HandlerInterceptor belongs to Spring MVC and used for custom logging, time measurement, HTTP header manipulation or (user) request context enhancement. A HandlerInterceptor may be placed before all or a specific Spring MVC controller and "lives" within the DispatcherServlet. In contrast, Spring Security's filter chain integrates with javax.servlet.Filter. A simplified request flow looks like this: Container connector --> Filter (Spring Security) --> DispatcherServlet (Spring MVC) --> HandlerInterceptor (Spring MVC) --> Controller (Spring MVC) Spring Security may be used independently from Spring MVC (Take a look at AbstractAuthenticationProcessingFilter and you can see that it derives from GenericFilterBean which in turn implements Filter). That said, you can incorporate authentication/authorization with Spring Security in any other web framework we should rely on a matured and feature rich framework like Spring Security or Apache Shiro for authentication/authorization. Most of the time such frameworks already have all the features our project requires. A popular framework that is used by many people reduces the probability of severe bugs or security holes due to frequent bug reports and security checks.

Author:

Kevendra Patidar

Constructor Summary

Constructors

Constructor and Description
OauthTokenValidationInterceptor()

Method Summary

Methods

Modifier and Type	Method and Description
void	afterCompletion(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Object handler, Exception ex)
void	postHandle(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Object handler, org.springframework.web.servlet.ModelAndView modelAndView)
boolean	preHandle(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Object handler) Http403ForbiddenEntryPoint : Authentication credentials not found Http401

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OauthTokenValidationInterceptor

public OauthTokenValidationInterceptor()

Method Detail

preHandle

public boolean preHandle(javax.servlet.http.HttpServletRequest request,
                javax.servlet.http.HttpServletResponse response,
                Object handler)
                  throws Exception

Http403ForbiddenEntryPoint : Authentication credentials not found Http401

Specified by:

preHandle in interface org.springframework.web.servlet.HandlerInterceptor

Throws:

Exception

postHandle

public void postHandle(javax.servlet.http.HttpServletRequest request,
              javax.servlet.http.HttpServletResponse response,
              Object handler,
              org.springframework.web.servlet.ModelAndView modelAndView)
                throws Exception

Specified by:

postHandle in interface org.springframework.web.servlet.HandlerInterceptor

Throws:

Exception

afterCompletion

public void afterCompletion(javax.servlet.http.HttpServletRequest request,
                   javax.servlet.http.HttpServletResponse response,
                   Object handler,
                   Exception ex)
                     throws Exception

Specified by:

afterCompletion in interface org.springframework.web.servlet.HandlerInterceptor

Throws:

Exception