View Javadoc

    1   /* Copyright 2004 Acegi Technology Pty Limited
    2    *
    3    * Licensed under the Apache License, Version 2.0 (the "License");
    4    * you may not use this file except in compliance with the License.
    5    * You may obtain a copy of the License at
    6    *
    7    *     http://www.apache.org/licenses/LICENSE-2.0
    8    *
    9    * Unless required by applicable law or agreed to in writing, software
    10   * distributed under the License is distributed on an "AS IS" BASIS,
    11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12   * See the License for the specific language governing permissions and
    13   * limitations under the License.
    14   */
    15
    16  package org.acegisecurity.securechannel;
    17
    18  import org.acegisecurity.ConfigAttribute;
    19  import org.acegisecurity.ConfigAttributeDefinition;
    20  import org.acegisecurity.intercept.web.FilterInvocation;
    21
    22  import org.springframework.beans.factory.InitializingBean;
    23  import org.springframework.util.Assert;
    24
    25  import java.io.IOException;
    26
    27  import java.util.Iterator;
    28
    29  import javax.servlet.ServletException;
    30
    31
    32  /***
    33   * <p>
    34   * Ensures channel security is active by review of
    35   * <code>HttpServletRequest.isSecure()</code> responses.
    36   * </p>
    37   *
    38   * <P>
    39   * The class responds to one case-sensitive keyword, {@link #getSecureKeyword}.
    40   * If this keyword is detected, <code>HttpServletRequest.isSecure()</code> is
    41   * used to determine the channel security offered. If channel security is not
    42   * present, the configured <code>ChannelEntryPoint</code> is called. By
    43   * default the entry point is {@link RetryWithHttpsEntryPoint}.
    44   * </p>
    45   *
    46   * <P>
    47   * The default <code>secureKeyword</code> is
    48   * <code>REQUIRES_SECURE_CHANNEL</code>.
    49   * </p>
    50   *
    51   * @author Ben Alex
    52   * @version $Id: SecureChannelProcessor.java,v 1.3 2005/11/17 00:55:50 benalex Exp $
    53   */
    54  public class SecureChannelProcessor implements InitializingBean,
    55      ChannelProcessor {
    56      //~ Instance fields ========================================================
    57
    58      private ChannelEntryPoint entryPoint = new RetryWithHttpsEntryPoint();
    59      private String secureKeyword = "REQUIRES_SECURE_CHANNEL";
    60
    61      //~ Methods ================================================================
    62
    63      public void setEntryPoint(ChannelEntryPoint entryPoint) {
    64          this.entryPoint = entryPoint;
    65      }
    66
    67      public ChannelEntryPoint getEntryPoint() {
    68          return entryPoint;
    69      }
    70
    71      public void setSecureKeyword(String secureKeyword) {
    72          this.secureKeyword = secureKeyword;
    73      }
    74
    75      public String getSecureKeyword() {
    76          return secureKeyword;
    77      }
    78
    79      public void afterPropertiesSet() throws Exception {
    80          Assert.hasLength(secureKeyword, "secureKeyword required");
    81          Assert.notNull(entryPoint, "entryPoint required");
    82      }
    83
    84      public void decide(FilterInvocation invocation,
    85          ConfigAttributeDefinition config) throws IOException, ServletException {
    86          Assert.isTrue((invocation != null) && (config != null), "Nulls cannot be provided");
    87
    88          Iterator iter = config.getConfigAttributes();
    89
    90          while (iter.hasNext()) {
    91              ConfigAttribute attribute = (ConfigAttribute) iter.next();
    92
    93              if (supports(attribute)) {
    94                  if (!invocation.getHttpRequest().isSecure()) {
    95                      entryPoint.commence(invocation.getRequest(),
    96                          invocation.getResponse());
    97                  }
    98              }
    99          }
    100     }
    101
    102     public boolean supports(ConfigAttribute attribute) {
    103         if ((attribute != null) && (attribute.getAttribute() != null)
    104             && attribute.getAttribute().equals(getSecureKeyword())) {
    105             return true;
    106         } else {
    107             return false;
    108         }
    109     }
    110 }