public class HttpMethodPermissionFilter extends PermissionsAuthorizationFilter
currently matching path.Subject isPermitted to
perform the resolved action, the request is allowed to continue./user/** = rest[user]Then an HTTP
GET request to /user/1234 would translate to the constructed permission
user:read (GET is mapped to the 'read' action) and execute the permission check
Subject.isPermitted("user:read") in order to allow the request to continue.
Similarly, an HTTP POST to /user would translate to the constructed permission
user:create (POST is mapped to the 'create' action) and execute the permission check
Subject.isPermitted("user:create") in order to allow the request to continue.
| HTTP Method | Mapped Action | Example Permission | Runtime Check |
|---|---|---|---|
| head | read | perm1 | perm1:read |
| get | read | perm2 | perm2:read |
| put | update | perm3 | perm3:update |
| post | create | perm4 | perm4:create |
| mkcol | create | perm5 | perm5:create |
| options | read | perm6 | perm6:read |
| trace | read | perm7 | perm7:read |
DEFAULT_LOGIN_URL, GET_METHOD, POST_METHODappliedPaths, pathMatcherALREADY_FILTERED_SUFFIXfilterConfig| Constructor and Description |
|---|
HttpMethodPermissionFilter()
Creates the filter instance with default method-to-action values in the instance's
http method actions map. |
| Modifier and Type | Method and Description |
|---|---|
protected String[] |
buildPermissions(HttpServletRequest request,
String[] configuredPerms,
String action)
Returns a collection of String permissions with which to perform a permission check to determine if the filter
will allow the request to continue.
|
protected String[] |
buildPermissions(String[] configuredPerms,
String action)
Builds a new array of permission strings based on the original argument, appending the specified action verb
to each one per
WildcardPermission conventions. |
protected String |
getHttpMethodAction(ServletRequest request)
Determines the action (verb) attempting to be performed on the filtered resource by the current request.
|
protected String |
getHttpMethodAction(String method)
Determines the corresponding application action that will be performed on the filtered resource based on the
specified HTTP method (GET, POST, etc).
|
protected Map<String,String> |
getHttpMethodActions()
Returns the HTTP Method name (key) to action verb (value) mapping used to resolve actions based on an
incoming
HttpServletRequest. |
boolean |
isAccessAllowed(ServletRequest request,
ServletResponse response,
Object mappedValue)
Resolves an 'application friendly' action verb based on the
HttpServletRequest's method, appends that
action to each configured permission (the mappedValue argument is a String[] array), and
delegates the permission check for the newly constructed permission(s) to the superclass
isAccessAllowed
implementation to perform the actual permission check. |
getUnauthorizedUrl, onAccessDenied, setUnauthorizedUrlgetLoginUrl, getSubject, isLoginRequest, onAccessDenied, onPreHandle, redirectToLogin, saveRequest, saveRequestAndRedirectToLogin, setLoginUrlgetPathWithinApplication, isEnabled, pathsMatch, pathsMatch, preHandle, processPathConfigafterCompletion, cleanup, doFilterInternal, executeChain, postHandledoFilter, getAlreadyFilteredAttributeName, isEnabled, isEnabled, isFilterOncePerRequest, setEnabled, setFilterOncePerRequest, shouldNotFiltergetName, setName, toStringBuilderdestroy, getFilterConfig, getInitParam, init, onFilterConfigSet, setFilterConfiggetContextAttribute, getContextInitParam, getServletContext, removeContextAttribute, setContextAttribute, setServletContext, toStringpublic HttpMethodPermissionFilter()
http method actions map.protected Map<String,String> getHttpMethodActions()
HttpServletRequest. All keys and values are lower-case. The
default key/value pairs are defined in the top class-level JavaDoc.protected String getHttpMethodAction(ServletRequest request)
HttpServletRequest and returns a mapped
action based on the HTTP request method.request - to pull the method from.protected String getHttpMethodAction(String method)
method - to be translated into the verb.protected String[] buildPermissions(HttpServletRequest request, String[] configuredPerms, String action)
buildPermissions(String[], String) and ignores the inbound
HTTP servlet request, but it can be overridden by subclasses for more complex request-specific building logic
if necessary.request - the inbound HTTP request - ignored in this implementation, but available to
subclasses for more complex construction building logic if necessaryconfiguredPerms - any url-specific permissions mapped to this filter in the URL rules mappings.action - the application-friendly action (verb) resolved based on the HTTP Method name.protected String[] buildPermissions(String[] configuredPerms, String action)
WildcardPermission conventions. The
built permission strings will be the ones used at runtime during the permission check that determines if filter
access should be allowed to continue or not.
For example, if the configuredPerms argument contains the following 3 permission strings:
read, then the return value will be:
WildcardPermission conventions. Subclasses
are of course free to override this method or the
buildPermissions request
variant for custom building logic or with different permission formats.configuredPerms - list of configuredPerms to be converted.action - the resolved action based on the request method to be appended to permission strings.public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException
HttpServletRequest's method, appends that
action to each configured permission (the mappedValue argument is a String[] array), and
delegates the permission check for the newly constructed permission(s) to the superclass
isAccessAllowed
implementation to perform the actual permission check.isAccessAllowed in class PermissionsAuthorizationFilterrequest - the inbound ServletRequestresponse - the outbound ServletResponsemappedValue - the filter-specific config value mapped to this filter in the URL rules mappings.true if the request should proceed through the filter normally, false if the
request should be processed by this filter's
AccessControlFilter.onAccessDenied(ServletRequest,ServletResponse,Object) method instead.IOExceptionCopyright © 2004–2023 The Apache Software Foundation. All rights reserved.