Package org.tynamo.security.shiro.authc

Class AnonymousFilter

java.lang.Object
org.apache.shiro.web.servlet.ServletContextSupport
org.apache.shiro.web.servlet.AbstractFilter
org.apache.shiro.web.servlet.NameableFilter
org.apache.shiro.web.servlet.OncePerRequestFilter
org.apache.shiro.web.servlet.AdviceFilter
org.tynamo.security.shiro.AccessControlFilter
org.tynamo.security.shiro.authc.AuthenticationFilter
org.tynamo.security.shiro.authc.AuthenticatingFilter
org.tynamo.security.shiro.authc.AnonymousFilter
All Implemented Interfaces:
jakarta.servlet.Filter, org.apache.shiro.lang.util.Nameable
public class AnonymousFilter extends AuthenticatingFilter
Filter that allows access to a path immeidately without performing security checks of any kind.

This filter is useful primarily in exclusionary policies, where you have defined a url pattern to require a certain security level, but maybe only subset of urls in that pattern should allow any access.

For example, if you had a user-only section of a website, you might want to require that access to any url in that section must be from an authenticated user.

Here is how that would look in the IniShiroFilter configuration:

[urls]
/user/** = authc

But if you wanted /user/signup/** to be available to anyone, you have to exclude that path since it is a subset of the first. This is where the AnonymousFilter ('anon') is useful:

[urls]
/user/signup/** = anon
/user/** = authc>

Since the url pattern definitions follow a 'first match wins' paradigm, the anon filter will match the /user/signup/** paths and the /user/** path chain will not be evaluated.

Since:
0.4.0

  • Constructor Details

  • Method Details

    • onPreHandle

      public boolean onPreHandle(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, Object mappedValue)
      Always returns true allowing unchecked access to the underlying path or resource.
      Overrides:
      onPreHandle in class AccessControlFilter
      Returns:
      true always, allowing unchecked access to the underlying path or resource.

    • createToken

      protected org.apache.shiro.authc.AuthenticationToken createToken(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response) throws Exception
      Specified by:
      createToken in class AuthenticatingFilter
      Throws:
      Exception

    • onAccessDenied

      protected boolean onAccessDenied(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response) throws Exception
      Description copied from class: AccessControlFilter
      Processes requests where the subject was denied access as determined by the isAccessAllowed method.
      Specified by:
      onAccessDenied in class AccessControlFilter
      Parameters:
      request - the incoming ServletRequest
      response - the outgoing ServletResponse
      Returns:
      true if the request should continue to be processed; false if the subclass will handle/render the response directly.
      Throws:
      Exception - if there is an error processing the request.