CODEWITHSUNDEEP
springrestspring-mvcspring-securityinterceptor
Alexander Burakevych
Alexander Burakevych

Reputation: 2426

Spring 3.2 REST API add cookie to the response outside controller

I'm using Spring 3.2.4 and Spring Security 3.2.3 to handle RESTful API call to "get security token" request that returns the token (which would be used to secure subsequent requests to the service). This is a POST request which has a body with username and password and is processed in the controller:

@RequestMapping(method = RequestMethod.POST, consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody
public SessionTokenResponse getSessionToken(@RequestBody Credentials credentials, ModelAndView interceptorModel) throws AccessException {
    final String token = webGate.getSessionTokenForUser(credentials.getUsername(), credentials.getPassword());
    LOGGER.debug("Logged in user : " + credentials.getUsername());

    interceptorModel.addObject(SessionConstants.INTERCEPTOR_MODEL_TOKEN_KEY, token); // Used by post-processing in interceptors, e.g. add Cookie

    return new SessionTokenResponse(ResponseMessages.SUCCESS, token);
}

After the controller has successfully finished processing the request I would like to add a cookie with the token to the response. I tried HandlerInterceptorAdapter implementation, but I cannot find the way to the the 'token' from the response or ModelAndView:

    @Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView interceptorModel) throws Exception {
    final String token = (String) interceptorModel.getModel().get(SessionConstants.INTERCEPTOR_MODEL_TOKEN_KEY);

    if (token != null) {
        final Cookie obsso = new Cookie(cookieName, token);
        obsso.setPath(cookiePathUri);
        obsso.setDomain(cookieDomain);
        obsso.setMaxAge(cookieMaxAge);

        response.addCookie(obsso);
    }
}

The interceptorModel is null . It seems that Spring MVC doesn't provide it to the postHandle since the @ResponseBody has been already resolved and there is no need for the ModelAndView anymore (this is just my assumption based on the debugging).

What is the correct way of achieving that (add cookie to the response) outside the controller in the interceptor or maybe listener?

Upvotes: 1

Views: 2383

Answers (1)

Louise Miller
Louise Miller

Reputation: 3189

To retrieve the token you can use the request object

 request.setAttribute(SessionConstants.INTERCEPTOR_MODEL_TOKEN_KEY, token);

and then in the postHandle

 String token = ( String ) request.getAttribute(SessionConstants.INTERCEPTOR_MODEL_TOKEN_KEY);

However I don't think you can add a cookie to the response object in postHandle as the response is already committed.

Perhaps you could store the token information on the servlet context instead.

In your controller, add the token information to the servlet context.
Then implement preHandle, so that every api call can check if token for that user exists on servlet context, if so you can add cookie to the response.

Upvotes: 1

Related Questions