我当前的代码是
@Path("login")
@RequestScoped
public class LoginResource {
@GET
@SecurityChecked
public Response getUser(@HeaderParam("AUTH") @Nonnull final String authToken) {
return Response.ok("authenticated successfully.").build();
}
}
and @SecurityChecked
自定义注释为
import java.lang.annotation.ElementType;
import java.lang.annotation.Inherited;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import javax.interceptor.InterceptorBinding;
@Inherited
@InterceptorBinding
@Target({ ElementType.TYPE, ElementType.METHOD })
@Retention(RetentionPolicy.RUNTIME)
public @interface SecurityChecked {
}
和拦截器类为
@Interceptor
@SecurityChecked
public class SecurityCheckInterceptor {
private static final Logger LOGGER = LoggerFactory.getLogger("SecurityCheckInterceptor");
@AroundInvoke
public Object validateUser(final InvocationContext context) throws Exception {
final Object[] params = context.getParameters();
LOGGER.info("Authentication token: " + Arrays.toString(params));
return context.proceed();
}
}
当我运行它时我看到
Authentication token: [1a629d035831feadOO4uFReLyEW8aTmrCS]
Problem?
- 在我的资源课程中,我必须通过@HeaderParam
范围
- 我怎样才能阅读所有HTTP
来自客户端的标头?
Ideal?
- 如果getUser()
不采取任何@HeaderParam
输入和
- 拦截器应该能够为您提供所有HTTP
标头
我怎样才能做到这一点?
我通过修改我的拦截器解决了这个问题,以下是代码
注解
@Inherited
@InterceptorBinding
@Target({ ElementType.TYPE, ElementType.METHOD })
@Retention(RetentionPolicy.RUNTIME)
public @interface SecurityChecked {
}
资源类
public class SecureResource {
@GET
@SecurityChecked
public Response getUser() {
return Response.ok("authenticated successfully!").build();
}
}
拦截器类
@Interceptor
@Provider
@ServerInterceptor
@SecurityChecked
public class SecurityCheckInterceptor implements PreProcessInterceptor, AcceptedByMethod {
private static final Logger LOGGER = LoggerFactory.getLogger(SecurityCheckInterceptor.class);
@Nullable
@Override
public ServerResponse preProcess(final HttpRequest request, final ResourceMethod method) throws Failure, WebApplicationException {
final List<String> authToken = request.getHttpHeaders().getRequestHeader("X-AUTH");
if (authToken == null || !isValidToken(authToken.get(0))) {
final ServerResponse serverResponse = new ServerResponse();
serverResponse.setStatus(Response.Status.UNAUTHORIZED.getStatusCode());
return serverResponse;
}
return null;
}
private static boolean isValidToken(@Nonnull final String authToken) {
LOGGER.info("validating token: " + authToken);
return true;
}
@SuppressWarnings("rawtypes")
@Override
public boolean accept(final Class declaring, final Method method) {
// return declaring.isAnnotationPresent(SecurityChecked.class); // if annotation on class
return method.isAnnotationPresent(SecurityChecked.class);
}
}
然后我通过在 JBoss 中部署资源类并在命令行上发出以下命令来运行集成测试
curl --header 'X-AUTH: 1a629d035831feadOOO4uFReLyEW8aTmrCS' http://localhost:8080/market-1.0-SNAPSHOT/rest/login
curl --header 'InvalidHeader: InvalidHeaderValue' http://localhost:8080/market-1.0-SNAPSHOT/rest/login
本文内容由网友自发贡献,版权归原作者所有,本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容,请联系:hwhale#tublm.com(使用前将#替换为@)