title: Spring Security - Custom Pre Auth filter using java config
body: <p>I am trying to configure a simple custom authentication filter that checks for a token on every page of the web app except the '/login' page. Right now, the filter is up and running, but no matter what settings I change, the filter is being called on every page, including '/login' which I have set to permitAll().</p>
  
  <p>When I access localhost:8080/login, I expect it to not call this filter based on my configuration below, but instead it throws an exception in the filter because no session is found.</p>
  
  <p>My question is how do I limit the filter to all pages except the '/login' page?</p>
  
  <p>Here is my config:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter{
  
  private UserDetailsService userDetailsService;
  private PreAuthenticatedAuthenticationProvider preAuthenticatedProvider;
  
  public SecurityConfig() {
      super();
  
      userDetailsService = new UserDetailsServiceImpl();
      UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt; wrapper = 
              new UserDetailsByNameServiceWrapper&lt;PreAuthenticatedAuthenticationToken&gt;(userDetailsService);
  
      preAuthenticatedProvider = new PreAuthenticatedAuthenticationProvider();
      preAuthenticatedProvider.setPreAuthenticatedUserDetailsService(wrapper);
  }
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(preAuthenticatedProvider);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      OpenTokenRequestAuthenticationFilter filter = new OpenTokenRequestAuthenticationFilter();
      filter.setAuthenticationManager(authenticationManager());
  
  
      http
          .addFilter(filter)
          .authorizeRequests()
              .antMatchers("/login").permitAll();
  }
  
  }
  </code></pre>
  
  <p>And here is the filter:</p>
  
  <pre><code>    public class OpenTokenRequestAuthenticationFilter extends
          AbstractPreAuthenticatedProcessingFilter {
  
      /**
       * logger for the class
       */
      private static final Logger logger = LoggerFactory.getLogger(OpenTokenRequestAuthenticationFilter.class);
  
      @Autowired
      private ExceptionMappingAuthenticationFailureHandler authenticationFailureHandler;
  
      @Autowired
      private IOpenTokenReader openTokenReader;
  
      private String logoutURL;
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse response,
              FilterChain chain) throws IOException, ServletException {
          HttpServletRequest httpServletRequest = (HttpServletRequest)request;
          HttpServletResponse httpServletResponse = (HttpServletResponse)response;
          super.doFilter(httpServletRequest, httpServletResponse, chain);
          HttpSession session = httpServletRequest.getSession(false);
          if(session != null &amp;&amp; session.getAttribute("ssoToken") != null)
          {
              SsoToken ssoToken = (SsoToken)session.getAttribute("ssoToken");
              httpServletResponse.addHeader("agentName", ssoToken.getName());
              httpServletResponse.addHeader("agentID", ""+ssoToken.getLoginId());
          }
      }
  
      /**
       * 
       */
      protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
          String principal = null;
          HttpSession session = null;
  
          try {
              session = request.getSession(false);
              String tokenName = openTokenReader.getTokenName();
  
              if (tokenName != null &amp;&amp; request.getParameter(tokenName.trim()) != null &amp;&amp; !request.getParameter(tokenName.trim()).isEmpty()) {
                  logger.info("Token found in request. Token Name:  "+ tokenName);
                  SsoToken ssoToken = null;
                  if (session != null) {
                      session.invalidate();
                      logger.info("Invalidated old session and creating a new session since request found with new token.");
                  }
                  session = request.getSession(true);//create new session
                  logger.info("New session created: "+session.getId());
  
                  Agent agent = openTokenReader.getAgent();
                  Map result = agent.readToken(request);
                  if (result != null) {
                      principal = (String) result.get("subject");
                      ssoToken = new SsoToken();
                      ssoToken.setLogoutURL(getLogoutURL());
  //                  ssoToken.setName((String) result.get("lastName") +", "+(String) result.get("firstName"));
                      ssoToken.setName((String) result.get("firstName"));
                      ssoToken.setAffiliate((result.get("isAffiliate") != null &amp;&amp; !((String)result.get("isAffiliate")).trim().equals("false")) ? true : false);
                      if(ssoToken.isAffiliate())
                          ssoToken.setLoginId((String) result.get("affiliateId"));
                      else
                          ssoToken.setLoginId((String) result.get("subject"));
                  }
                  session.setAttribute("ssoToken", ssoToken);
                  boolean isInValidToken = hasInvalidTokenData(ssoToken);
                  if (isInValidToken) {
                      throw new PreAuthenticatedCredentialsNotFoundException("Invalid Token found in request.");
                  } else {
                      session.setAttribute("hasValidToken", true);
                  }
              }
  
          } catch (Exception e) {
              logger.error("Exception while reading token " + e);
          }
          if(session == null )
              throw new PreAuthenticatedCredentialsNotFoundException("No session found.");
          if(session != null &amp;&amp; session.getAttribute("hasValidToken") == null)
              throw new PreAuthenticatedCredentialsNotFoundException("No attribute 'hasValidToken' found in session.");
          if(session != null &amp;&amp; session.getAttribute("hasValidToken") != null &amp;&amp; !(Boolean) session.getAttribute("hasValidToken"))
              throw new PreAuthenticatedCredentialsNotFoundException("value of  attribute 'hasValidToken' is false in session.");
  
          /*if (session == null || session.getAttribute("hasValidToken") == null || !((Boolean) session.getAttribute("hasValidToken"))){
              throw new PreAuthenticatedCredentialsNotFoundException("Token not found in request.");
          }*/
          if(session != null &amp;&amp; session.getAttribute("ssoToken") != null)
          {
              SsoToken ssoToken = (SsoToken)session.getAttribute("ssoToken");
              principal = ssoToken.getLoginId();
          }
  
          return principal;
      }
      public boolean hasInvalidTokenData(SsoToken token) {
          boolean hasInvalidTokenData = false;
          if (token == null) {
              hasInvalidTokenData = true;
          } else {
              if (StringUtils.isBlank(token.getLoginId())) {
                  logger.debug("Login ID was blank.");
                  hasInvalidTokenData = true;
              }
          }
          if (logger.isDebugEnabled()) {
              logger.debug("Exiting: hasInvalidTokenData(SsoToken)");
              logger.debug("hasInvalidTokenData=|" + hasInvalidTokenData + "|");
          }
          return hasInvalidTokenData;
      }
      @Override
      protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
          return "";
      }
  
      /**
       * @return the logoutURL
       */
      public String getLogoutURL() {
          return logoutURL;
      }
  
      /**
       * @param logoutURL the logoutURL to set
       */
      public void setLogoutURL(String logoutURL) {
          this.logoutURL = logoutURL;
      }
  
      public void setAuthenticationFailureHandler(ExceptionMappingAuthenticationFailureHandler authenticationFailureHandler){
          this.authenticationFailureHandler = authenticationFailureHandler;
      }
  
      public ExceptionMappingAuthenticationFailureHandler getAuthenticationFailureHandler(){
          return authenticationFailureHandler;
      }
  </code></pre>