Class BearerTokenAuthenticationFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.web.filter.OncePerRequestFilter
ubic.gemma.rest.security.BearerTokenAuthenticationFilter
All Implemented Interfaces:
jakarta.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware
public class BearerTokenAuthenticationFilter extends org.springframework.web.filter.OncePerRequestFilter
Spring Security filter that resolves an Authorization: Bearer <opaque> header to a Authentication previously issued by AuthWebService.login(AuthWebService.LoginRequest) and stored in TokenStore.

If the header is present and the token is valid, the corresponding Authentication is placed on the SecurityContextHolder for the remainder of the request. If the header is absent or the token is unknown / expired, the filter is a no-op: the chain continues and the standard BasicAuthenticationFilter (registered immediately after this one in RestSecurityConfig) gets a chance to authenticate via HTTP Basic. This preserves the legacy CLI / script / RClient code paths that still rely on Basic.

Order: registered via .addFilterBefore(..., BasicAuthenticationFilter.class) in RestSecurityConfig.

See Also:

  • Field Summary

    Fields inherited from class org.springframework.web.filter.OncePerRequestFilter

    ALREADY_FILTERED_SUFFIX

    Fields inherited from class org.springframework.web.filter.GenericFilterBean

    logger

  • Constructor Summary

    Constructors
    Constructor
    Description
    BearerTokenAuthenticationFilter(TokenStore tokenStore)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    doFilterInternal(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, jakarta.servlet.FilterChain filterChain)
     
    static String
    extractBearerToken(String headerValue)
    Extract the bare opaque token from an Authorization header value, or null if the header is missing / not a Bearer scheme / has an empty token.

    Methods inherited from class org.springframework.web.filter.OncePerRequestFilter

    doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilter, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch

    Methods inherited from class org.springframework.web.filter.GenericFilterBean

    addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • BearerTokenAuthenticationFilter

      public BearerTokenAuthenticationFilter(TokenStore tokenStore)

  • Method Details

    • extractBearerToken

      public static String extractBearerToken(String headerValue)
      Extract the bare opaque token from an Authorization header value, or null if the header is missing / not a Bearer scheme / has an empty token.

      Public so AuthWebService.logout(HttpServletRequest) can use the same parsing rule the filter uses (so a logout call with a malformed header still 200s rather than NPE'ing on substring math).

    • doFilterInternal

      protected void doFilterInternal(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException
      Specified by:
      doFilterInternal in class org.springframework.web.filter.OncePerRequestFilter
      Throws:
      jakarta.servlet.ServletException
      IOException