org.jsecurity.web.filter.authz
Class AuthorizationFilter

java.lang.Object
  org.jsecurity.web.servlet.ServletContextSupport
      org.jsecurity.web.servlet.OncePerRequestFilter
          org.jsecurity.web.servlet.AdviceFilter
              org.jsecurity.web.filter.PathMatchingFilter
                  org.jsecurity.web.filter.AccessControlFilter
                      org.jsecurity.web.filter.authz.AuthorizationFilter

All Implemented Interfaces:

Filter, Nameable, PathConfigProcessor

Direct Known Subclasses:

PermissionsAuthorizationFilter, RolesAuthorizationFilter

public abstract class AuthorizationFilter
extends AccessControlFilter

Superclass for authorization-related filters. For unauthorized requests, this filter redirects to the login page if the current user is unknown (i.e. not authenticated or remembered). If the user is known, the filter redirects to an unauthorized URL or returns an unauthorized HTTP status code if no unauthorized URL is specified.

Since:

0.9

Author:

Les Hazlewood, Jeremy Haile

Field Summary

Fields inherited from class org.jsecurity.web.filter.AccessControlFilter

DEFAULT_LOGIN_URL, GET_METHOD, POST_METHOD

Fields inherited from class org.jsecurity.web.filter.PathMatchingFilter

appliedPaths, pathMatcher

Fields inherited from class org.jsecurity.web.servlet.OncePerRequestFilter

ALREADY_FILTERED_SUFFIX, filterConfig

Fields inherited from class org.jsecurity.web.servlet.ServletContextSupport

HTTP_SESSION_MODE, JSECURITY_SESSION_MODE, SESSION_MODE_CONTEXT_PARAM_NAME

Constructor Summary

AuthorizationFilter()

Method Summary

protected String	getUnauthorizedUrl()
protected boolean	onAccessDenied(ServletRequest request, ServletResponse response) Processes requests where the subject was denied access as determined by the isAccessAllowed method.
void	setUnauthorizedUrl(String unauthorizedUrl)

Methods inherited from class org.jsecurity.web.filter.AccessControlFilter

getLoginUrl, getSubject, isAccessAllowed, isLoginRequest, onPreHandle, redirectToLogin, saveRequest, saveRequestAndRedirectToLogin, setLoginUrl

Methods inherited from class org.jsecurity.web.filter.PathMatchingFilter

getPathWithinApplication, pathsMatch, pathsMatch, preHandle, processPathConfig

Methods inherited from class org.jsecurity.web.servlet.AdviceFilter

afterCompletion, cleanup, doFilterInternal, executeChain, postHandle

Methods inherited from class org.jsecurity.web.servlet.OncePerRequestFilter

destroy, doFilter, getAlreadyFilteredAttributeName, getFilterConfig, getName, init, onFilterConfigSet, setFilterConfig, setName, shouldNotFilter

Methods inherited from class org.jsecurity.web.servlet.ServletContextSupport

bind, getAttribute, getContextInitParam, getServletContext, removeAttribute, setAttribute, setServletContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AuthorizationFilter

public AuthorizationFilter()

Method Detail

getUnauthorizedUrl

protected String getUnauthorizedUrl()

setUnauthorizedUrl

public void setUnauthorizedUrl(String unauthorizedUrl)

onAccessDenied

protected boolean onAccessDenied(ServletRequest request,
                                 ServletResponse response)
                          throws IOException

Description copied from class: AccessControlFilter

Processes requests where the subject was denied access as determined by the isAccessAllowed method.

Specified by:

onAccessDenied in class AccessControlFilter

Parameters:

request - the incoming ServletRequest

response - the outgoing ServletResponse

Returns:

true if the request should continue to be processed; false if the subclass will handle/render the response directly.

Throws:

IOException