ClientAuthenticationFilter implements Filter { @Override public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) resp; String appId = accessKeyUtil.extractAppIdFromRequest(request); if (StringUtils.isBlank(appId)) { response.sendError(HttpServletResponse.SC_BAD_REQUEST, "InvalidAppId"); return; } List<String> availableSecrets = accessKeyUtil.findAvailableSecret(appId); if (!CollectionUtils.isEmpty(availableSecrets)) { String timestamp = request.getHeader(Signature.HTTP_HEADER_TIMESTAMP); String authorization = request.getHeader(HttpHeaders.AUTHORIZATION); if (!checkTimestamp(timestamp)) { logger.warn("Invalid timestamp. appId={},timestamp={}", appId, timestamp); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "RequestTimeTooSkewed"); return; } String uri = request.getRequestURI(); String query = request.getQueryString(); if (!checkAuthorization(authorization, availableSecrets, timestamp, uri, query)) { logger.warn("Invalid authorization. appId={},authorization={}", appId, authorization); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); return; } } chain.doFilter(request, response); } ClientAuthenticationFilter(AccessKeyUtil accessKeyUtil); @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain); @Override void destroy();  }
@Test public void testInvalidAppId() throws Exception { when(accessKeyUtil.extractAppIdFromRequest(any())).thenReturn(null); clientAuthenticationFilter.doFilter(request, response, filterChain); verify(response).sendError(HttpServletResponse.SC_BAD_REQUEST, "InvalidAppId"); verify(filterChain, never()).doFilter(request, response); }
@Test public void testRequestTimeTooSkewed() throws Exception { String appId = "someAppId"; List<String> secrets = Lists.newArrayList("someSecret"); String oneMinAgoTimestamp = Long.toString(System.currentTimeMillis() - 61 * 1000); when(accessKeyUtil.extractAppIdFromRequest(any())).thenReturn(appId); when(accessKeyUtil.findAvailableSecret(appId)).thenReturn(secrets); when(request.getHeader(Signature.HTTP_HEADER_TIMESTAMP)).thenReturn(oneMinAgoTimestamp); clientAuthenticationFilter.doFilter(request, response, filterChain); verify(response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "RequestTimeTooSkewed"); verify(filterChain, never()).doFilter(request, response); }
@Test public void testRequestTimeOneMinFasterThenCurrentTime() throws Exception { String appId = "someAppId"; List<String> secrets = Lists.newArrayList("someSecret"); String oneMinAfterTimestamp = Long.toString(System.currentTimeMillis() + 61 * 1000); when(accessKeyUtil.extractAppIdFromRequest(any())).thenReturn(appId); when(accessKeyUtil.findAvailableSecret(appId)).thenReturn(secrets); when(request.getHeader(Signature.HTTP_HEADER_TIMESTAMP)).thenReturn(oneMinAfterTimestamp); clientAuthenticationFilter.doFilter(request, response, filterChain); verify(response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "RequestTimeTooSkewed"); verify(filterChain, never()).doFilter(request, response); }
@Test public void testUnauthorized() throws Exception { String appId = "someAppId"; String availableSignature = "someSignature"; List<String> secrets = Lists.newArrayList("someSecret"); String oneMinAgoTimestamp = Long.toString(System.currentTimeMillis()); String errorAuthorization = "Apollo someAppId:wrongSignature"; when(accessKeyUtil.extractAppIdFromRequest(any())).thenReturn(appId); when(accessKeyUtil.findAvailableSecret(appId)).thenReturn(secrets); when(accessKeyUtil.buildSignature(any(), any(), any(), any())).thenReturn(availableSignature); when(request.getHeader(Signature.HTTP_HEADER_TIMESTAMP)).thenReturn(oneMinAgoTimestamp); when(request.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(errorAuthorization); clientAuthenticationFilter.doFilter(request, response, filterChain); verify(response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); verify(filterChain, never()).doFilter(request, response); }
@Test public void testAuthorizedSuccessfully() throws Exception { String appId = "someAppId"; String availableSignature = "someSignature"; List<String> secrets = Lists.newArrayList("someSecret"); String oneMinAgoTimestamp = Long.toString(System.currentTimeMillis()); String correctAuthorization = "Apollo someAppId:someSignature"; when(accessKeyUtil.extractAppIdFromRequest(any())).thenReturn(appId); when(accessKeyUtil.findAvailableSecret(appId)).thenReturn(secrets); when(accessKeyUtil.buildSignature(any(), any(), any(), any())).thenReturn(availableSignature); when(request.getHeader(Signature.HTTP_HEADER_TIMESTAMP)).thenReturn(oneMinAgoTimestamp); when(request.getHeader(HttpHeaders.AUTHORIZATION)).thenReturn(correctAuthorization); clientAuthenticationFilter.doFilter(request, response, filterChain); verify(response, never()).sendError(HttpServletResponse.SC_BAD_REQUEST, "InvalidAppId"); verify(response, never()).sendError(HttpServletResponse.SC_UNAUTHORIZED, "RequestTimeTooSkewed"); verify(response, never()).sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); verify(filterChain, times(1)).doFilter(request, response); }