CODEWITHSUNDEEP
javaservlets
Nacho321
Nacho321

Reputation: 1991

Servlet filter "returning" an object for later use

I'm implementing security in my RESTful webservice, and I'm thinking of creating a filter that checks if the Authorization header is valid or not, and this check is done by sending the token to a third party endpoint. If the token is valid, the third party endpoint has to send me a response that contains information regarding the token's expiration, client id, scope, and other stuff. The logic, then, is this:

@Override
public void doFilter(
        final ServletRequest request, 
        final ServletResponse response,
        final FilterChain chain) throws IOException, ServletException {
    HttpServletRequest req = (HttpServletRequest) request;
    header = req.getHeader("Authorization");
    EndpointResponse eResponse = Endpoint.validate(header);
    if(eResponse.valid())){
      chain.doFilter(...);
      return eResponse; //or equivalent
    }else{
      HttpServletResponse res = HttpServletResponse(response);
      res.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
      ...
    }
}

Then, in a DAO class, I will use the eResponse like this

public final class DAO{    
    public void checks(){
        if(eResponse.scope() == "ADMIN"){
            ...
        }else{
            ...
        }
    }
}

Is there a way to inject or return an object after the filter does the validation? Hopefully, without using spring or hibernate, since I can't use these at my job.

-EDIT-

The way I'm accessing the DAO would be like this

@Path("")
public class CertificationService {

    @GET
    @Produces(CertificationApplication.SUPPORTED_REPRESENTATIONS)
    @Path(CertificationConstants.URL_PATH)
    public Response getCertificationByUpId(String upId) throws CertificationException {        
        ResponseBuilder response;    
        try{
            response = Response.ok(DAO.findCertificationByUPID(upId));
        } catch (CertificationException e) {
            response = handleException(e);
        }
        return response.build();
    }


 }

The findCertificationByUPID method would have to call the checks() method I declared above.

Upvotes: 0

Views: 397

Answers (1)

user41871
user41871

Reputation:

Try placing the object on the request using setAttribute():

request.setAttribute("auth", eResponse);

Then your controller can grab the object using

EndpointResponse eResponse = (EndpointResponse) request.getAttribute("auth");

and do whatever you like with it (including passing it to the DAO):

dao.checks(eResponse);

where DAO is like what you have above, but with

public void checks(EndpointResponse eResponse) { ... }

instead.

If you prefer to keep the EndpointResponse out of the DAO, you can do

public void checks(String role) { ... }

or similar.

Upvotes: 1

Related Questions