@Test public void shouldANotllowUnauthenticatedRestUsersEndpointWithPOSTAndActionForgotIdFromSession() throws IOException, ServletException, NotFoundException { HttpServletRequest request = mock(HttpServletRequest.class); HttpServletResponse response = mock(HttpServletResponse.class); FilterChain filterChain = mock(FilterChain.class); given(request.getContextPath()).willReturn("/openam"); given(request.getRequestURI()).willReturn("/openam/json/users"); given(request.getQueryString()).willReturn("other1=valueA&_action=idFromSession&other2=valueb"); given(request.getMethod()).willReturn("POST"); given(request.getRequestURL()).willReturn(new StringBuffer("http: Map<String, String> details = new HashMap<String, String>(); details.put("resourceName", "/users"); given(restDispatcher.getRequestDetails("/users")).willReturn(details); amAuthNFilter.doFilter(request, response, filterChain); verify(filterChain, never()).doFilter(request, response); }
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; String contextPath = request.getContextPath(); String requestURI = request.getRequestURI(); String path = requestURI.substring(contextPath.length()); if (endpointMatcher.match(request)) { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Added as exception. Not protected."); filterChain.doFilter(servletRequest, servletResponse); } else { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Protected resource."); super.doFilter(servletRequest, servletResponse, filterChain); } }
AMAuthNFilter extends AuthNFilter { public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; String contextPath = request.getContextPath(); String requestURI = request.getRequestURI(); String path = requestURI.substring(contextPath.length()); if (endpointMatcher.match(request)) { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Added as exception. Not protected."); filterChain.doFilter(servletRequest, servletResponse); } else { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Protected resource."); super.doFilter(servletRequest, servletResponse, filterChain); } } }
AMAuthNFilter extends AuthNFilter { public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; String contextPath = request.getContextPath(); String requestURI = request.getRequestURI(); String path = requestURI.substring(contextPath.length()); if (endpointMatcher.match(request)) { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Added as exception. Not protected."); filterChain.doFilter(servletRequest, servletResponse); } else { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Protected resource."); super.doFilter(servletRequest, servletResponse, filterChain); } } AMAuthNFilter();  AMAuthNFilter(RestDispatcher restDispatcher); }
AMAuthNFilter extends AuthNFilter { public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; String contextPath = request.getContextPath(); String requestURI = request.getRequestURI(); String path = requestURI.substring(contextPath.length()); if (endpointMatcher.match(request)) { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Added as exception. Not protected."); filterChain.doFilter(servletRequest, servletResponse); } else { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Protected resource."); super.doFilter(servletRequest, servletResponse, filterChain); } } AMAuthNFilter();  AMAuthNFilter(RestDispatcher restDispatcher); void init(FilterConfig filterConfig); void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain); }
AMAuthNFilter extends AuthNFilter { public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; String contextPath = request.getContextPath(); String requestURI = request.getRequestURI(); String path = requestURI.substring(contextPath.length()); if (endpointMatcher.match(request)) { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Added as exception. Not protected."); filterChain.doFilter(servletRequest, servletResponse); } else { DEBUG.message("Path: " + path + " Method: " + request.getMethod() + " Protected resource."); super.doFilter(servletRequest, servletResponse, filterChain); } } AMAuthNFilter();  AMAuthNFilter(RestDispatcher restDispatcher); void init(FilterConfig filterConfig); void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain);  }