WSO2 ESB OAuth2处理程序，如何处理大型Post的无效令牌。

Question

I have implemented OAuth2 handler by using this tutorial https://docs.wso2.org/display/ESB481/Securing+APIs#SecuringAPIs-GettingtheOAuthtoken

In case,when invalid token is used I'm unable to clear body before sending unauthorized response back to client. I've tried to clear Soap Body before sending message back but still original Post data is sent back to client. HTTP status code is changed to 401.

Is there any way to empty soap body in Oauth2 handler before sending response back ?

In OAuth2 tutorial, handler only returns true/false depending of token validation. If I do that request when handler returns false, request will just hang without getting any response back. Should it work without sending response back manually inside handler ?

Here's my current code snippet:

public boolean handleRequest(MessageContext msgCtx) {

....

boolean isValid = stub.validate(dto).getValid();

if (!isValid)
{ 
     log.error("is not valid token");

      Axis2MessageContext axis2smc = (Axis2MessageContext) msgCtx;
      org.apache.axis2.context.MessageContext axis2MessageCtx =                 axis2smc.getAxis2MessageContext();
      axis2MessageCtx.setProperty("HTTP_SC", "401");
      axis2MessageCtx.setProperty("DISABLE_CHUNKING", true);
      axis2MessageCtx.setProperty("NO_ENTITY_BODY", new Boolean("true"));
      msgCtx.setProperty("RESPONSE", "true");
      msgCtx.setTo(null);

// Trying to flush response body with dummy tags, but this does not work
// However it works in Custom mediator implemention.
      try {
           SOAPBody body = msgCtx.getEnvelope().getBody();
           body.setFirstChild(AXIOMUtil.stringToOM("<p></p>"));

       } 

      catch (XMLStreamException e) {
       log.error(e.getStackTrace());
       }

      Axis2Sender.sendBack(msgCtx);
      return false;
   }

      return isValid;
 }

Thanks for any tips.

Answer 1

I think payloadFactory can do exactly what you're looking to do. It will set the soap body to contents you specify. The documentation on this transform mediator is here: https://docs.wso2.org/display/ESB481/PayloadFactory+Mediator

You could even take the chance to provide useful information in the soap response, like the token request url and proper oAuth2.0 request syntax.