org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestWrapper Maven / Gradle / Ivy
/*
* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.servletapi;
import java.security.Principal;
import java.util.Collection;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequestWrapper;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.context.SecurityContextHolderStrategy;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.util.Assert;
/**
* A Spring Security-aware HttpServletRequestWrapper
, which uses the
* SecurityContext
-defined Authentication
object to implement
* the servlet API security methods:
*
*
* - {@link #getUserPrincipal()}
* - {@link SecurityContextHolderAwareRequestWrapper#isUserInRole(String)}
* - {@link HttpServletRequestWrapper#getRemoteUser()}.
*
*
* @author Orlando Garcia Carmona
* @author Ben Alex
* @author Luke Taylor
* @author Rob Winch
* @see SecurityContextHolderAwareRequestFilter
*/
public class SecurityContextHolderAwareRequestWrapper extends HttpServletRequestWrapper {
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
.getContextHolderStrategy();
private final AuthenticationTrustResolver trustResolver;
/**
* The prefix passed by the filter. It will be prepended to any supplied role values
* before comparing it with the roles obtained from the security context.
*/
private final String rolePrefix;
/**
* Creates a new instance with {@link AuthenticationTrustResolverImpl}.
* @param request
* @param rolePrefix
*/
public SecurityContextHolderAwareRequestWrapper(HttpServletRequest request, String rolePrefix) {
this(request, new AuthenticationTrustResolverImpl(), rolePrefix);
}
/**
* Creates a new instance
* @param request the original {@link HttpServletRequest}
* @param trustResolver the {@link AuthenticationTrustResolver} to use. Cannot be
* null.
* @param rolePrefix The prefix to be added to {@link #isUserInRole(String)} or null
* if no prefix.
*/
public SecurityContextHolderAwareRequestWrapper(HttpServletRequest request,
AuthenticationTrustResolver trustResolver, String rolePrefix) {
super(request);
Assert.notNull(trustResolver, "trustResolver cannot be null");
this.rolePrefix = rolePrefix;
this.trustResolver = trustResolver;
}
/**
* Obtain the current active Authentication
* @return the authentication object or null
*/
private Authentication getAuthentication() {
Authentication auth = this.securityContextHolderStrategy.getContext().getAuthentication();
return (this.trustResolver.isAuthenticated(auth)) ? auth : null;
}
/**
* Returns the principal's name, as obtained from the
* SecurityContextHolder
. Properly handles both String
-based
* and UserDetails
-based principals.
* @return the username or null
if unavailable
*/
@Override
public String getRemoteUser() {
Authentication auth = getAuthentication();
if ((auth == null) || (auth.getPrincipal() == null)) {
return null;
}
if (auth.getPrincipal() instanceof UserDetails) {
return ((UserDetails) auth.getPrincipal()).getUsername();
}
if (auth instanceof AbstractAuthenticationToken) {
return auth.getName();
}
return auth.getPrincipal().toString();
}
/**
* Returns the Authentication
(which is a subclass of
* Principal
), or null
if unavailable.
* @return the Authentication
, or null
*/
@Override
public Principal getUserPrincipal() {
Authentication auth = getAuthentication();
if ((auth == null) || (auth.getPrincipal() == null)) {
return null;
}
return auth;
}
private boolean isGranted(String role) {
Authentication auth = getAuthentication();
if (this.rolePrefix != null && role != null && !role.startsWith(this.rolePrefix)) {
role = this.rolePrefix + role;
}
if ((auth == null) || (auth.getPrincipal() == null)) {
return false;
}
Collection authorities = auth.getAuthorities();
if (authorities == null) {
return false;
}
for (GrantedAuthority grantedAuthority : authorities) {
if (role.equals(grantedAuthority.getAuthority())) {
return true;
}
}
return false;
}
/**
* Simple searches for an exactly matching
* {@link org.springframework.security.core.GrantedAuthority#getAuthority()}.
*
* Will always return false
if the SecurityContextHolder
* contains an Authentication
with null
* principal
and/or GrantedAuthority[]
objects.
* @param role the GrantedAuthority
String
representation to
* check for
* @return true
if an exact (case sensitive) matching granted
* authority is located, false
otherwise
*/
@Override
public boolean isUserInRole(String role) {
return isGranted(role);
}
@Override
public String toString() {
return "SecurityContextHolderAwareRequestWrapper[ " + getRequest() + "]";
}
/**
* Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
* the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
*
* @since 5.8
*/
public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
this.securityContextHolderStrategy = securityContextHolderStrategy;
}
}