1   package com.atlassian.plugins.rest.module.servlet;
2   
3   import java.io.IOException;
4   import javax.servlet.Filter;
5   import javax.servlet.FilterChain;
6   import javax.servlet.FilterConfig;
7   import javax.servlet.ServletException;
8   import javax.servlet.ServletRequest;
9   import javax.servlet.ServletResponse;
10  import javax.servlet.http.HttpServletRequest;
11  import javax.servlet.http.HttpServletResponse;
12  /**
13   * This filter needs to run before Seraph's SecurityFilter. It will set a request attribute that tells Seraph
14   * "this request is on REST so use a default os_authType of 'any'". For more details look at the
15   * https://extranet.atlassian.com/display/DEV/Rest+Authentication+Specification+Proposal
16   * @since v2.1
17   */
18  public class RestSeraphFilter implements Filter
19  {
20      // This *must* be the same thing as in com.atlassian.seraph.auth.AuthType
21      public static final String DEFAULT_ATTRIBUTE = "os_authTypeDefault";
22  
23      public void init(final FilterConfig filterConfig) throws ServletException
24      {
25      }
26  
27      public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
28              throws IOException, ServletException
29      {
30          final HttpServletRequest httpRequest = (HttpServletRequest) request;
31          final HttpServletResponse httpResponse = (HttpServletResponse) response;
32  
33          if (httpRequest.getServletPath().startsWith("/rest/"))
34          {
35              // Only set it if someone before us hasn't already done so.
36              if (httpRequest.getAttribute(DEFAULT_ATTRIBUTE) == null)
37              {
38                  httpRequest.setAttribute(DEFAULT_ATTRIBUTE, "any");
39              }
40              chain.doFilter(request, httpResponse);
41          }
42          else
43          {
44              chain.doFilter(request, response);
45          }
46      }
47  
48      public void destroy()
49      {
50      }
51  }