Java : Intercept all requests before they go to login authentication

Question

I want to intercept ALL the requests in a filter first. I also have a login authentication which is applied to ALL the requests i.e. both the filter and login authentication are configured to intercept ALL the requests.

However, when any request is made, it is first intercepted by login authentication which tries to render login page. I would like the request to be intercepted by the filter first and then by the login authentication.

Following is the relevant code.

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    id="WebApp_ID" version="2.5">
    <display-name>Tango</display-name>

    <filter>
        <filter-name>SalsaValidationFilter</filter-name>
        <filter-class>net.semandex.salsa.validationFilters.SalsaValidationFilter</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>SalsaValidationFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <!-- <servlet-name>SalsaValidationServlet</servlet-name> -->
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

    <session-config>
        <session-timeout>20</session-timeout>
    </session-config>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Login page images</web-resource-name>
            <url-pattern>/images/salsadb-logo2.png</url-pattern>
            <url-pattern>/images/salsa-icon.png</url-pattern>
            <url-pattern>/images/shadow_box.png</url-pattern>
            <url-pattern>/images/header.png</url-pattern>
            <url-pattern>/images/bg.png</url-pattern>
            <url-pattern>/css/splash.css</url-pattern>
            <url-pattern>/WEB-INF/licenseValidation.html</url-pattern>
            <url-pattern>/auth/licenseValidation.html</url-pattern>
        </web-resource-collection>
    </security-constraint>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>The entire webapp</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>SalsaUser</role-name>
        </auth-constraint>
    </security-constraint>

    <security-role>
        <role-name>SalsaUser</role-name>
    </security-role>

    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
          <form-login-page>/auth/login.jsp</form-login-page>
          <form-error-page>/auth/loginError.jsp</form-error-page>
        </form-login-config>

        <realm-name>mongo_login</realm-name>
    </login-config>
</web-app>

Some more details: This is the flow of events that happen. Let's say request for home page is made, it is first handled by login authentication which tries to render the login page. Login page has some images and css. Hence requests are made for these images. These requests are intercepted by the filter.

Filter

public class SalsaValidationFilter implements Filter {

    private ServletContext context;

    public void init(FilterConfig fConfig) throws ServletException {
        this.context = fConfig.getServletContext();
        this.context.log("SalsaValidationFilter initialized");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;

        String uri = req.getRequestURI();
        this.context.log("Requested Resource::"+uri);

        HttpSession session = req.getSession(false);

        boolean licenseValid = false;
        if( !licenseValid && !uri.endsWith("licenseValidation.html") ){
            this.context.log("NO valid license was found");
            // pass the request along the filter chain
            res.sendRedirect( req.getContextPath() +  "/auth/licenseValidation.html");
            return;
        }
        //else{
            chain.doFilter(req, res);
        //}
    }

    public void destroy() {
        //close any resources here
    }

}

Any idea how I can ensure that filter intercepts the requests first?

You can find similar question here http://stackoverflow.com/questions/17654020/precedence-of-security-constraint-over-filters-in-servlets and here http://stackoverflow.com/questions/10356361/filtering-requests-involving-security-constraints — Tech Enthusiast, Dec 23 '15 at 07:52

score 2 · Accepted Answer · answered Mar 15 '16 at 14:17

Any idea how I can ensure that filter intercepts the requests first?

You need to install a special kind of filter called a ServerAuthModule, also known as a SAM.

This special filter comes from Java EE's JASPIC spec and is called before any other filter or servlet is called, and it's the dedicated place where you should do things related to security in Java EE.

score 0 · Answer 2 · answered Dec 23 '15 at 07:55

That is not possible due to specification and security restrictions, the container will processes the security constraints before the filter.

You could remove remove the security constraint and dynamically login in all the pages you need using HttpServletRequest#login() method in Servlet 3.0.

Java : Intercept all requests before they go to login authentication

2 Answers2

Linked