package com.pollex.pam.security.jwt;
|
|
import java.io.IOException;
|
import java.util.Optional;
|
|
import javax.servlet.FilterChain;
|
import javax.servlet.ServletException;
|
import javax.servlet.ServletRequest;
|
import javax.servlet.ServletResponse;
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.security.core.Authentication;
|
import org.springframework.security.core.context.SecurityContextHolder;
|
import org.springframework.stereotype.Component;
|
import org.springframework.util.StringUtils;
|
import org.springframework.web.filter.GenericFilterBean;
|
|
import com.pollex.pam.business.domain.TokenBlackList;
|
import com.pollex.pam.business.repository.TokenBlackListRepository;
|
|
/**
|
* Filters incoming requests and installs a Spring Security principal if a header corresponding to a valid user is
|
* found.
|
*/
|
public class JWTFilter extends GenericFilterBean {
|
|
public static final String AUTHORIZATION_HEADER = "Authorization";
|
|
public static final String AUTHORIZATION_TOKEN = "access_token";
|
|
private final TokenProvider tokenProvider;
|
|
|
public JWTFilter(TokenProvider tokenProvider) {
|
this.tokenProvider = tokenProvider;
|
}
|
|
@Override
|
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
|
throws IOException, ServletException {
|
HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
|
String jwt = resolveToken(httpServletRequest);
|
if(StringUtils.hasText(jwt) && !jwt.equals("null")) {
|
boolean isBlackToken = this.tokenProvider.isBlackListToken(jwt);
|
if(isBlackToken) {
|
HttpServletResponse response = (HttpServletResponse) servletResponse;
|
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
}
|
}
|
|
if (StringUtils.hasText(jwt) && this.tokenProvider.validateToken(jwt)) {
|
|
Authentication authentication = this.tokenProvider.getAuthentication(jwt);
|
SecurityContextHolder.getContext().setAuthentication(authentication);
|
}
|
|
filterChain.doFilter(servletRequest, servletResponse);
|
}
|
|
private String resolveToken(HttpServletRequest request) {
|
|
String bearerToken = request.getHeader(AUTHORIZATION_HEADER);
|
if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
|
return bearerToken.substring(7);
|
}
|
String jwt = request.getParameter(AUTHORIZATION_TOKEN);
|
|
if (StringUtils.hasText(jwt)) {
|
return jwt;
|
}
|
return null;
|
}
|
}
|
