JwtFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(@NonNull final HttpServletRequest request, @NonNull final HttpServletResponse response, @NonNull final FilterChain chain) throws ServletException, IOException { Claims claims = null; String token = ""; if (!RequestMethod.OPTIONS.toString().equals(request.getMethod())) { final String authHeader = request.getHeader(HEADER_AUTHORIZATION); if (authHeader == null || !authHeader.startsWith(BEARER_PREFIX)) { LOGGER.info("Missing or invalid Authorization header."); claims = new DefaultClaims().setSubject(SUBJECT_ANONYMOUS); } else { try { token = authHeader.substring(BEARER_PREFIX.length()); claims = Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody(); } catch (final JwtException e) { LOGGER.warn("Unable to get claims from bearer token: {}", e.getMessage()); } if (claims == null || claims.getSubject() == null) { claims = new DefaultClaims().setSubject(SUBJECT_ANONYMOUS); } } request.setAttribute(JWT_ATTRIBUTE, claims); response.setHeader(JWT_TOKEN, token); response.setHeader(HEADER_CLAIMS, claims.toString()); response.setHeader(HEADER_CLAIMS_SUBJECT, claims.getSubject()); response.setHeader(HEADER_CLAIMS_USER_ID, claims.getId()); } chain.doFilter(request, response); }   static final String ATTRIBUTE_CLAIMS; static final String BEARER_PREFIX; static final String HEADER_AUTHORIZATION; static final String HEADER_CLAIMS; static final String HEADER_CLAIMS_SUBJECT; static final String HEADER_CLAIMS_USER_ID; static final String SECRET_KEY; static final String SUBJECT_ANONYMOUS; static final String JWT_TOKEN; static final String JWT_ATTRIBUTE; static final String ANONYMOUS_USER_ID; }
@Test public void testNullAuthorizationHeader() throws ServletException, IOException { jwtFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain); Mockito.verify(mockHttpServletRequest).getMethod(); Mockito.verify(mockHttpServletRequest).setAttribute(JwtFilter.JWT_ATTRIBUTE, new DefaultClaims().setSubject(JwtFilter.SUBJECT_ANONYMOUS)); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.JWT_TOKEN, ""); Mockito.verify(mockHttpServletRequest).getHeader(JwtFilter.HEADER_AUTHORIZATION); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.HEADER_CLAIMS_SUBJECT, JwtFilter.SUBJECT_ANONYMOUS); Mockito.verify(mockFilterChain).doFilter(mockHttpServletRequest, mockHttpServletResponse); Mockito.verify(mockHttpServletResponse, Mockito.times(4)).setHeader(ArgumentMatchers.anyString(), ArgumentMatchers.any()); }
@Test public void testNotBearerAuthorizationHeader() throws ServletException, IOException { Mockito.when(mockHttpServletRequest.getHeader(JwtFilter.HEADER_AUTHORIZATION)).thenReturn(HEADER_NOT_BEARER); jwtFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain); Mockito.verify(mockHttpServletRequest).getMethod(); Mockito.verify(mockHttpServletRequest).setAttribute(JwtFilter.JWT_ATTRIBUTE, new DefaultClaims().setSubject(JwtFilter.SUBJECT_ANONYMOUS)); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.JWT_TOKEN, ""); Mockito.verify(mockHttpServletRequest).getHeader(JwtFilter.HEADER_AUTHORIZATION); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.HEADER_CLAIMS_SUBJECT, JwtFilter.SUBJECT_ANONYMOUS); Mockito.verify(mockFilterChain).doFilter(mockHttpServletRequest, mockHttpServletResponse); Mockito.verify(mockHttpServletResponse, Mockito.times(4)).setHeader(ArgumentMatchers.anyString(), ArgumentMatchers.any()); }
@Test public void testBadBearerAuthorizationHeader() throws ServletException, IOException { Mockito.when(mockHttpServletRequest.getMethod()).thenReturn(RequestMethod.POST.name()); Mockito.when(mockHttpServletRequest.getHeader(JwtFilter.HEADER_AUTHORIZATION)).thenReturn(HEADER_BAD_BEARER); jwtFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain); Mockito.verify(mockHttpServletRequest).getMethod(); Mockito.verify(mockHttpServletRequest).setAttribute(JwtFilter.JWT_ATTRIBUTE, new DefaultClaims().setSubject(JwtFilter.SUBJECT_ANONYMOUS)); Mockito.verify(mockHttpServletRequest).getHeader(JwtFilter.HEADER_AUTHORIZATION); Mockito.verify(mockFilterChain).doFilter(mockHttpServletRequest, mockHttpServletResponse); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.HEADER_CLAIMS_SUBJECT, JwtFilter.SUBJECT_ANONYMOUS); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.JWT_TOKEN, "GARBAGE"); Mockito.verify(mockHttpServletResponse, Mockito.times(4)).setHeader(ArgumentMatchers.anyString(), ArgumentMatchers.any()); }
@Test public void testEmptyCredentials() throws ServletException, IOException { Mockito.when(mockHttpServletRequest.getHeader(JwtFilter.HEADER_AUTHORIZATION)) .thenReturn(HEADER_EMPTY_CREDENTIALS); jwtFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain); Mockito.verify(mockHttpServletRequest).getMethod(); Mockito.verify(mockHttpServletRequest).setAttribute(JwtFilter.JWT_ATTRIBUTE, new DefaultClaims().setSubject(JwtFilter.SUBJECT_ANONYMOUS)); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.JWT_TOKEN, "eyJhbGciOiJIUzI1NiJ9.eyJyb2xlcyI6IiIsImlhdCI6MH0.nEBg6Bj7PLGALFT2rs4wDfhvUfA91b7XLNog029crUA"); Mockito.verify(mockHttpServletRequest).getHeader(JwtFilter.HEADER_AUTHORIZATION); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.HEADER_CLAIMS_SUBJECT, JwtFilter.SUBJECT_ANONYMOUS); Mockito.verify(mockFilterChain).doFilter(mockHttpServletRequest, mockHttpServletResponse); Mockito.verify(mockHttpServletResponse, Mockito.times(4)).setHeader(ArgumentMatchers.anyString(), ArgumentMatchers.any()); }
@Test public void testNormalCredentials() throws ServletException, IOException { Mockito.when(mockHttpServletRequest.getHeader(JwtFilter.HEADER_AUTHORIZATION)) .thenReturn(HEADER_VALID_CREDENTIALS); jwtFilter.doFilterInternal(mockHttpServletRequest, mockHttpServletResponse, mockFilterChain); final Claims expectedClaims = new DefaultClaims().setSubject(VALID_CREDENTIALS_SUBJECT); expectedClaims.put("roles", ""); expectedClaims.put("iat", 0); Mockito.verify(mockHttpServletRequest).getMethod(); Mockito.verify(mockHttpServletRequest).setAttribute(JwtFilter.JWT_ATTRIBUTE, expectedClaims); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.JWT_TOKEN, "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ2YWxpZCIsInJvbGVzIjoiIiwiaWF0IjowfQ.lzdLJW9bdkXZLc57_YcXm0cJL87ZFSrPLEOD1-nYR8Q"); Mockito.verify(mockHttpServletRequest).getHeader(JwtFilter.HEADER_AUTHORIZATION); Mockito.verify(mockHttpServletResponse).setHeader(JwtFilter.HEADER_CLAIMS_SUBJECT, VALID_CREDENTIALS_SUBJECT); Mockito.verify(mockFilterChain).doFilter(mockHttpServletRequest, mockHttpServletResponse); Mockito.verify(mockHttpServletResponse, Mockito.times(4)).setHeader(ArgumentMatchers.anyString(), ArgumentMatchers.any()); }