spring boot security authentication to verify body contents

Question

I want to Authenticate one of the post request body key-value pair, but I want to do the same with the help of a Interceptor/Filter. How can I do that?

Answer 1

You can create a custom request filter that will check the request:

public class MyFilter implements OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) {
        var user = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        // do stuff you need to do here
        
        filterChain.doFilter(request, response);
    }
}

and then in your WebSecurityConfiguration class register the filter like this

public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterAfter(new MyFilter(), BasicAuthenticationFilter.class);
    }
}

Answer 2

You can extend HandlerInterceptorAdapter and perform your custom operations/filters on top of request by overriding preHandle() method.

Pseudocode is here:

@Component
public class SimpleInterceptor extends HandlerInterceptorAdapter {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        // Handle your request here. In your case, authentication check should go here.
        return true;
    }
}

Add the SimpleInterceptor to the registry to intercept the requests.

@Configuration
@EnableWebMvc
public class SimpleMvnConfigurer implements WebMvcConfigurer {

    @Autowired
    SimpleInterceptor simpleInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(simpleInterceptor);
    }
}

That's all!
EDIT 1: To send the response from preHandle method, follow below pseudocode:

@Override                                                                                           
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
    // Handle your request here. AIn your case, authentication check should go here.                
    if (!isValidAuth()) {                                                                           
        // Populate the response here.                                                              
        try {                                                                                       
            response.setStatus(401);                                                                
            response.getWriter().write("Authentication failed.");                                   
        } catch (IOException e) {                                                                   
            e.printStackTrace();                                                                    
        }                                                                                           
        return false;                                                                               
    }                                                                                               
    return true;                                                                                    
}                                                                                                   ```

Answer 3

You can try this with Filter.

public class SimpleFilter implements Filter {

    private void throwUnauthorized(ServletResponse res) throws IOException {
        HttpServletResponse response = (HttpServletResponse) res;
        response.reset();
        response.setHeader("Content-Type", "application/json;charset=UTF-8");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;

        if (!isValidAuth(request)) {
            throwUnauthorized(res);
        }
        chain.doFilter(req, res);

    }

    private boolean isValidAuth(HttpServletRequest request) {
        // YOUR LOGIC GOES HERE.
        return false;
    }

    @Override
    public void destroy() {
    }

    @Override
    public void init(FilterConfig arg0) {
    }

}

Register the filter using FilterRegistrationBean

@Bean                                                                                      
public FilterRegistrationBean<SimpleFilter> simpleFilter() {                               
    FilterRegistrationBean<SimpleFilter> registrationBean = new FilterRegistrationBean<>();
    registrationBean.setFilter(new SimpleFilter());                                        
                                                                                           
    return registrationBean;                                                               
}                                                                                          

Let me know if this works.