JwtFilter implements AuthenticationFilter { @Override public void handle(Request request, Response response) throws Exception { if (!request.requestMethod().equals(OPTIONS)) { Optional<String> bearer = Optional.ofNullable(request.headers(AUTHORIZATION_HEADER_NAME)) .filter(value -> value.startsWith(AUTHORIZATION_HEADER_PREFIX)) .map(value -> value.substring(AUTHORIZATION_HEADER_PREFIX.length())); checkHeaderPresent(bearer); checkValidSignature(bearer); checkIsAdmin(bearer); String login = jwtTokenVerifier.extractLogin(bearer.get()); request.attribute(LOGIN, login); } } @Inject  JwtFilter(JwtTokenVerifier jwtTokenVerifier); @Override void handle(Request request, Response response); static final String AUTHORIZATION_HEADER_PREFIX; static final String AUTHORIZATION_HEADER_NAME; static final String OPTIONS; }
@Test public void handleShouldDoNothingOnOptions() throws Exception { Request request = mock(Request.class); when(request.requestMethod()).thenReturn(new String("OPTIONS")); Response response = mock(Response.class); jwtFilter.handle(request, response); verifyZeroInteractions(response); }
@Test public void handleShouldRejectRequestWithHeaders() throws Exception { Request request = mock(Request.class); when(request.requestMethod()).thenReturn("GET"); when(request.headers()).thenReturn(ImmutableSet.of()); expectedException.expect(HaltException.class); expectedException.expect(STATUS_CODE_MATCHER_401); jwtFilter.handle(request, mock(Response.class)); }
@Test public void handleShouldRejectRequestWithBearersHeaders() throws Exception { Request request = mock(Request.class); when(request.requestMethod()).thenReturn("GET"); when(request.headers(JwtFilter.AUTHORIZATION_HEADER_NAME)).thenReturn("Invalid value"); expectedException.expect(HaltException.class); expectedException.expect(STATUS_CODE_MATCHER_401); jwtFilter.handle(request, mock(Response.class)); }
@Test public void handleShouldRejectRequestWithInvalidBearerHeaders() throws Exception { Request request = mock(Request.class); when(request.requestMethod()).thenReturn("GET"); when(request.headers(JwtFilter.AUTHORIZATION_HEADER_NAME)).thenReturn("Bearer value"); when(jwtTokenVerifier.verify("value")).thenReturn(false); expectedException.expect(HaltException.class); expectedException.expect(STATUS_CODE_MATCHER_401); jwtFilter.handle(request, mock(Response.class)); }
@Test public void handleShouldRejectRequestWithoutAdminClaim() throws Exception { Request request = mock(Request.class); when(request.requestMethod()).thenReturn("GET"); when(request.headers(JwtFilter.AUTHORIZATION_HEADER_NAME)).thenReturn("Bearer value"); when(jwtTokenVerifier.verify("value")).thenReturn(true); when(jwtTokenVerifier.hasAttribute("admin", true, "value")).thenReturn(false); expectedException.expect(HaltException.class); expectedException.expect(STATUS_CODE_MATCHER_401); jwtFilter.handle(request, mock(Response.class)); }
@Test public void handleShouldAcceptValidJwt() throws Exception { Request request = mock(Request.class); when(request.requestMethod()).thenReturn("GET"); when(request.headers(JwtFilter.AUTHORIZATION_HEADER_NAME)).thenReturn("Bearer value"); when(jwtTokenVerifier.verify("value")).thenReturn(true); when(jwtTokenVerifier.hasAttribute("admin", true, "value")).thenReturn(true); jwtFilter.handle(request, mock(Response.class)); }