View Javadoc

1   /* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.securechannel;
17  
18  import org.acegisecurity.ConfigAttribute;
19  import org.acegisecurity.ConfigAttributeDefinition;
20  
21  import org.acegisecurity.intercept.web.FilterInvocation;
22  
23  import org.springframework.beans.factory.InitializingBean;
24  
25  import org.springframework.util.Assert;
26  
27  import java.io.IOException;
28  
29  import java.util.Iterator;
30  
31  import javax.servlet.ServletException;
32  
33  
34  /**
35   * <p>Ensures channel security is active by review of <code>HttpServletRequest.isSecure()</code> responses.</p>
36   *  <P>The class responds to one case-sensitive keyword, {@link #getSecureKeyword}. If this keyword is detected,
37   * <code>HttpServletRequest.isSecure()</code> is used to determine the channel security offered. If channel security
38   * is not present, the configured <code>ChannelEntryPoint</code> is called. By default the entry point is {@link
39   * RetryWithHttpsEntryPoint}.</p>
40   *  <P>The default <code>secureKeyword</code> is <code>REQUIRES_SECURE_CHANNEL</code>.</p>
41   *
42   * @author Ben Alex
43   * @version $Id: SecureChannelProcessor.java 1496 2006-05-23 13:38:33Z benalex $
44   */
45  public class SecureChannelProcessor implements InitializingBean, ChannelProcessor {
46      //~ Instance fields ================================================================================================
47  
48      private ChannelEntryPoint entryPoint = new RetryWithHttpsEntryPoint();
49      private String secureKeyword = "REQUIRES_SECURE_CHANNEL";
50  
51      //~ Methods ========================================================================================================
52  
53      public void afterPropertiesSet() throws Exception {
54          Assert.hasLength(secureKeyword, "secureKeyword required");
55          Assert.notNull(entryPoint, "entryPoint required");
56      }
57  
58      public void decide(FilterInvocation invocation, ConfigAttributeDefinition config)
59          throws IOException, ServletException {
60          Assert.isTrue((invocation != null) && (config != null), "Nulls cannot be provided");
61  
62          Iterator iter = config.getConfigAttributes();
63  
64          while (iter.hasNext()) {
65              ConfigAttribute attribute = (ConfigAttribute) iter.next();
66  
67              if (supports(attribute)) {
68                  if (!invocation.getHttpRequest().isSecure()) {
69                      entryPoint.commence(invocation.getRequest(), invocation.getResponse());
70                  }
71              }
72          }
73      }
74  
75      public ChannelEntryPoint getEntryPoint() {
76          return entryPoint;
77      }
78  
79      public String getSecureKeyword() {
80          return secureKeyword;
81      }
82  
83      public void setEntryPoint(ChannelEntryPoint entryPoint) {
84          this.entryPoint = entryPoint;
85      }
86  
87      public void setSecureKeyword(String secureKeyword) {
88          this.secureKeyword = secureKeyword;
89      }
90  
91      public boolean supports(ConfigAttribute attribute) {
92          if ((attribute != null) && (attribute.getAttribute() != null)
93              && attribute.getAttribute().equals(getSecureKeyword())) {
94              return true;
95          } else {
96              return false;
97          }
98      }
99  }