AccessTokenInCookieFilter.java

/*
 * Copyright 2019 Global Crop Diversity Trust
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.genesys.server.servlet.filter;

import java.io.IOException;
import java.util.Collections;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.filter.OncePerRequestFilter;;

/**
 * Uses value of access_token cookie for "Authorization" header if it is not provided.
 * 
 * @author Matija Obreza
 */
public class AccessTokenInCookieFilter extends OncePerRequestFilter {

	public static final Logger LOG = LoggerFactory.getLogger(AccessTokenInCookieFilter.class);

	@Value("${base.url}")
	private String baseUrl;


	@Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

		String authorizationHeader = request.getHeader("Authorization");
		Cookie[] cookies = request.getCookies();
		String accessToken = null;

		String tokenCookieName = "access_token";

		if (authorizationHeader == null && cookies != null) {
			for (Cookie cookie : cookies) {
				if (cookie.getName().equalsIgnoreCase(tokenCookieName)) {
					accessToken = cookie.getValue();
					break;
				}
			}
		}

		if (authorizationHeader == null && StringUtils.isNotBlank(accessToken)) {
			LOG.debug("Using access token from cookie!");
			// Wrap the request
			CustomHeadersRequest customHeadersRequest = new CustomHeadersRequest(request);
			customHeadersRequest.addHeader("Authorization", "Bearer " + accessToken);
			filterChain.doFilter(customHeadersRequest, response);
			return;
		}

		filterChain.doFilter(request, response);
	}

	static class CustomHeadersRequest extends HttpServletRequestWrapper {
		private Map<String, String> customHeaders = new HashMap<>();

		public CustomHeadersRequest(HttpServletRequest request) {
			super(request);
		}

		public void addHeader(String name, String value) {
			customHeaders.put(name, value);
		}

		@Override
		public String getHeader(String name) {
			if (customHeaders.containsKey(name)) {
				return customHeaders.get(name);
			}
			return super.getHeader(name);
		}

		@Override
		public Enumeration<String> getHeaderNames() {
			List<String> names = Collections.list(super.getHeaderNames());
			names.addAll(customHeaders.keySet());
			return Collections.enumeration(names);
		}

		@Override
		public Enumeration<String> getHeaders(String name) {
			List<String> values = Collections.list(super.getHeaders(name));
			if (customHeaders.containsKey(name)) {
				values.add(customHeaders.get(name));
			}
			return Collections.enumeration(values);
		}
	}
}