Here when user sends a request in https protocol to apache webserver. apache webserver will made a call to application server with http protocol.
apache server retries the http response from application server.
Apache server sends the http response to the user.
Here user is sending https request and getting the response in http.
Below steps are to handle the above issue.
Defining LoginUrlAuthenticationEntryPoint: -
==============================
Here when user tries to acess any url customAuthenticationFilter will be called.
For log out also customLogoutFilter will be called.
<http auto-config="false" entry-point-ref="LoginUrlAuthenticationEntryPoint" use-expressions="true">
<intercept-url pattern="/login.html" filters="none" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<intercept-url pattern="/update/*" access="hasAnyRole('ROLE_ADMIN','ROLE_DEV')" />
<custom-filter position="FORM_LOGIN_FILTER" ref="customAuthenticationFilter" />
<custom-filter position="LOGOUT_FILTER" ref="customLogoutFilter"/>
</http>
====================================================
Defining customAuthenticationFilter:-
============================
Depending upon the result of CustomAuthenticationFilter filter successHandler or failureHandler will be called.
<beans:bean id="customAuthenticationFilter" class="com.CustomAuthenticationFilter" >
<beans:property name="authenticationManager" ref="authenticationManager" />
<beans:property name="authenticationFailureHandler" ref="failureHandler" />
<beans:property name="authenticationSuccessHandler" ref="successHandler" />
</beans:bean>
======================================================
Defining successHandler: -
====================
In successHandler we are defining customRedirect startegy.
<beans:bean id="successHandler" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="redirectStrategy" ref="customRedirect"/>
<beans:property name="defaultTargetUrl" value="/" />
</beans:bean>
==============================
Creating the HttpsRedirectStratergy class:
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
public class HttpsRedirectStratergy extends DefaultRedirectStrategy{
private Logger logger = LoggerFactory.getLogger(this.getClass());
@Override
public void sendRedirect(HttpServletRequest request, HttpServletResponse response,
String redirectUrl) throws IOException {
StringBuffer httpsRedirectUrl = new StringBuffer("https");
logger.debug("In send Redirect");
logger.debug("redirect URL : " + redirectUrl);
if(!redirectUrl.startsWith("https") && redirectUrl.startsWith("http"))
{
httpsRedirectUrl.append(redirectUrl.substring(4,redirectUrl.length()));
}
logger.debug("Redirected after authentication to : " + httpsRedirectUrl.toString());
//response.sendRedirect(redirectUrl);
super.sendRedirect(request, response, httpsRedirectUrl.toString());
logger.debug("End send Redirect");
}
}
=====================
Thanks,
Sudharsana M
apache server retries the http response from application server.
Apache server sends the http response to the user.
Here user is sending https request and getting the response in http.
Below steps are to handle the above issue.
Defining LoginUrlAuthenticationEntryPoint: -
==============================
Here when user tries to acess any url customAuthenticationFilter will be called.
For log out also customLogoutFilter will be called.
<http auto-config="false" entry-point-ref="LoginUrlAuthenticationEntryPoint" use-expressions="true">
<intercept-url pattern="/login.html" filters="none" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<intercept-url pattern="/update/*" access="hasAnyRole('ROLE_ADMIN','ROLE_DEV')" />
<custom-filter position="FORM_LOGIN_FILTER" ref="customAuthenticationFilter" />
<custom-filter position="LOGOUT_FILTER" ref="customLogoutFilter"/>
</http>
====================================================
Defining customAuthenticationFilter:-
============================
Depending upon the result of CustomAuthenticationFilter filter successHandler or failureHandler will be called.
<beans:bean id="customAuthenticationFilter" class="com.CustomAuthenticationFilter" >
<beans:property name="authenticationManager" ref="authenticationManager" />
<beans:property name="authenticationFailureHandler" ref="failureHandler" />
<beans:property name="authenticationSuccessHandler" ref="successHandler" />
</beans:bean>
======================================================
Defining successHandler: -
====================
In successHandler we are defining customRedirect startegy.
<beans:bean id="successHandler" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="redirectStrategy" ref="customRedirect"/>
<beans:property name="defaultTargetUrl" value="/" />
</beans:bean>
==============================
Creating the HttpsRedirectStratergy class:
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.RedirectStrategy;
public class HttpsRedirectStratergy extends DefaultRedirectStrategy{
private Logger logger = LoggerFactory.getLogger(this.getClass());
@Override
public void sendRedirect(HttpServletRequest request, HttpServletResponse response,
String redirectUrl) throws IOException {
StringBuffer httpsRedirectUrl = new StringBuffer("https");
logger.debug("In send Redirect");
logger.debug("redirect URL : " + redirectUrl);
if(!redirectUrl.startsWith("https") && redirectUrl.startsWith("http"))
{
httpsRedirectUrl.append(redirectUrl.substring(4,redirectUrl.length()));
}
logger.debug("Redirected after authentication to : " + httpsRedirectUrl.toString());
//response.sendRedirect(redirectUrl);
super.sendRedirect(request, response, httpsRedirectUrl.toString());
logger.debug("End send Redirect");
}
}
=====================
Thanks,
Sudharsana M
No comments:
Post a Comment