|
| 1 | +/** |
| 2 | + * ShinyProxy |
| 3 | + * |
| 4 | + * Copyright (C) 2016-2021 Open Analytics |
| 5 | + * |
| 6 | + * =========================================================================== |
| 7 | + * |
| 8 | + * This program is free software: you can redistribute it and/or modify |
| 9 | + * it under the terms of the Apache License as published by |
| 10 | + * The Apache Software Foundation, either version 2 of the License, or |
| 11 | + * (at your option) any later version. |
| 12 | + * |
| 13 | + * This program is distributed in the hope that it will be useful, |
| 14 | + * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 | + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 16 | + * Apache License for more details. |
| 17 | + * |
| 18 | + * You should have received a copy of the Apache License |
| 19 | + * along with this program. If not, see <http://www.apache.org/licenses/> |
| 20 | + */ |
| 21 | +package eu.openanalytics.shinyproxy; |
| 22 | + |
| 23 | +import eu.openanalytics.shinyproxy.controllers.AppController; |
| 24 | +import org.springframework.security.access.AccessDeniedException; |
| 25 | +import org.springframework.security.core.AuthenticationException; |
| 26 | +import org.springframework.security.core.context.SecurityContextHolder; |
| 27 | +import org.springframework.security.web.AuthenticationEntryPoint; |
| 28 | +import org.springframework.security.web.access.ExceptionTranslationFilter; |
| 29 | +import org.springframework.security.web.util.ThrowableAnalyzer; |
| 30 | +import org.springframework.security.web.util.matcher.AntPathRequestMatcher; |
| 31 | +import org.springframework.security.web.util.matcher.OrRequestMatcher; |
| 32 | +import org.springframework.security.web.util.matcher.RequestMatcher; |
| 33 | +import org.springframework.web.filter.GenericFilterBean; |
| 34 | + |
| 35 | +import javax.servlet.FilterChain; |
| 36 | +import javax.servlet.ServletException; |
| 37 | +import javax.servlet.ServletRequest; |
| 38 | +import javax.servlet.ServletResponse; |
| 39 | +import javax.servlet.http.HttpServletRequest; |
| 40 | +import javax.servlet.http.HttpServletResponse; |
| 41 | +import java.io.IOException; |
| 42 | + |
| 43 | +/** |
| 44 | + * A filter that blocks the default {@link AuthenticationEntryPoint} when requests are made to certain endpoints. |
| 45 | + * These endpoints are: |
| 46 | + * - /app_direct_i/* /* /** (without spaces), i.e. any subpath on the app_direct endpoint (thus not the page that loads the app) |
| 47 | + * - /heartbeat/* , i.e. heartbeat requests |
| 48 | + * |
| 49 | + * When the filter detects that a user is not authenticated when requesting one of these endpoints, it returns the response: |
| 50 | + * {"status":"error", "message":"shinyproxy_authentication_required"} with status code 401. |
| 51 | + * This response is specific unique enough such that it can be handled by the frontend. |
| 52 | + * |
| 53 | + * See {@link AppController#appDirect} where a similar approach is used for apps that have been stopped. |
| 54 | + * |
| 55 | + * Note: this cannot be easily implemented as a {@link AuthenticationEntryPoint} since these entrypoints are sometimes, |
| 56 | + * but not always overridden by the authentication backend. |
| 57 | + */ |
| 58 | +public class AuthenticationRequiredFilter extends GenericFilterBean { |
| 59 | + |
| 60 | + private final ThrowableAnalyzer throwableAnalyzer = new DefaultThrowableAnalyzer(); |
| 61 | + |
| 62 | + private static final RequestMatcher REQUEST_MATCHER = new OrRequestMatcher( |
| 63 | + new AntPathRequestMatcher("/app_direct_i/*/*/**"), |
| 64 | + new AntPathRequestMatcher("/heartbeat/*")); |
| 65 | + |
| 66 | + public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { |
| 67 | + HttpServletRequest request = (HttpServletRequest) req; |
| 68 | + HttpServletResponse response = (HttpServletResponse) res; |
| 69 | + |
| 70 | + try { |
| 71 | + chain.doFilter(request, response); |
| 72 | + } catch (IOException ex) { |
| 73 | + throw ex; |
| 74 | + } catch (Exception ex) { |
| 75 | + if (REQUEST_MATCHER.matches(request) && isAuthException(ex)) { |
| 76 | + if (response.isCommitted()) { |
| 77 | + throw new ServletException("Unable to handle the Spring Security Exception because the response is already committed.", ex); |
| 78 | + } |
| 79 | + SecurityContextHolder.getContext().setAuthentication(null); |
| 80 | + response.setStatus(401); |
| 81 | + response.getWriter().write("{\"status\":\"error\", \"message\":\"shinyproxy_authentication_required\"}"); |
| 82 | + return; |
| 83 | + } |
| 84 | + throw ex; |
| 85 | + } |
| 86 | + } |
| 87 | + |
| 88 | + /** |
| 89 | + * @param ex the exception to check |
| 90 | + * @return whether this exception indicates that the user is not authenticated |
| 91 | + */ |
| 92 | + private boolean isAuthException(Exception ex) { |
| 93 | + Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex); |
| 94 | + RuntimeException ase = (AuthenticationException) throwableAnalyzer.getFirstThrowableOfType(AuthenticationException.class, causeChain); |
| 95 | + if (ase != null) { |
| 96 | + return true; |
| 97 | + } |
| 98 | + ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(AccessDeniedException.class, causeChain); |
| 99 | + return ase != null; |
| 100 | + } |
| 101 | + |
| 102 | + /** |
| 103 | + * Based on {@link ExceptionTranslationFilter.DefaultThrowableAnalyzer} |
| 104 | + */ |
| 105 | + private static final class DefaultThrowableAnalyzer extends ThrowableAnalyzer { |
| 106 | + protected void initExtractorMap() { |
| 107 | + super.initExtractorMap(); |
| 108 | + |
| 109 | + registerExtractor(ServletException.class, throwable -> { |
| 110 | + ThrowableAnalyzer.verifyThrowableHierarchy(throwable, |
| 111 | + ServletException.class); |
| 112 | + return ((ServletException) throwable).getRootCause(); |
| 113 | + }); |
| 114 | + } |
| 115 | + } |
| 116 | + |
| 117 | +} |
0 commit comments