org.jsecurity.web.servlet
Class JSecurityHttpServletResponse

java.lang.Object
  javax.servlet.ServletResponseWrapper
      javax.servlet.http.HttpServletResponseWrapper
          org.jsecurity.web.servlet.JSecurityHttpServletResponse

All Implemented Interfaces:

HttpServletResponse, ServletResponse

public class JSecurityHttpServletResponse
extends HttpServletResponseWrapper

HttpServletResponse implementation to support URL Encoding of JSecurity Session IDs. It is only used when using JSecurity's native Session Management configuration (and not when using the Servlet Container session configuration, which is JSecurity's default in a web environment). Because the servlet container already performs url encoding of its own session ids, instances of this class are only needed when using JSecurity native sessions.

Note that this implementation relies in part on source code from the Tomcat 6.x distribution for encoding URLs for session ID URL Rewriting (we didn't want to re-invent the wheel). Since JSecurity is also Apache 2.0 license, all regular licenses and conditions have remained in tact.

Since:

0.2

Author:

Les Hazlewood

Field Summary

Fields inherited from interface javax.servlet.http.HttpServletResponse

SC_ACCEPTED, SC_BAD_GATEWAY, SC_BAD_REQUEST, SC_CONFLICT, SC_CONTINUE, SC_CREATED, SC_EXPECTATION_FAILED, SC_FORBIDDEN, SC_FOUND, SC_GATEWAY_TIMEOUT, SC_GONE, SC_HTTP_VERSION_NOT_SUPPORTED, SC_INTERNAL_SERVER_ERROR, SC_LENGTH_REQUIRED, SC_METHOD_NOT_ALLOWED, SC_MOVED_PERMANENTLY, SC_MOVED_TEMPORARILY, SC_MULTIPLE_CHOICES, SC_NO_CONTENT, SC_NON_AUTHORITATIVE_INFORMATION, SC_NOT_ACCEPTABLE, SC_NOT_FOUND, SC_NOT_IMPLEMENTED, SC_NOT_MODIFIED, SC_OK, SC_PARTIAL_CONTENT, SC_PAYMENT_REQUIRED, SC_PRECONDITION_FAILED, SC_PROXY_AUTHENTICATION_REQUIRED, SC_REQUEST_ENTITY_TOO_LARGE, SC_REQUEST_TIMEOUT, SC_REQUEST_URI_TOO_LONG, SC_REQUESTED_RANGE_NOT_SATISFIABLE, SC_RESET_CONTENT, SC_SEE_OTHER, SC_SERVICE_UNAVAILABLE, SC_SWITCHING_PROTOCOLS, SC_TEMPORARY_REDIRECT, SC_UNAUTHORIZED, SC_UNSUPPORTED_MEDIA_TYPE, SC_USE_PROXY

Constructor Summary

JSecurityHttpServletResponse(HttpServletResponse wrapped, ServletContext context, JSecurityHttpServletRequest request)

Method Summary

String	encodeRedirectUrl(String s)
String	encodeRedirectURL(String url) Encode the session identifier associated with this response into the specified redirect URL, if necessary.
String	encodeUrl(String s)
String	encodeURL(String url) Encode the session identifier associated with this response into the specified URL, if necessary.
ServletContext	getContext()
JSecurityHttpServletRequest	getRequest()
protected boolean	isEncodeable(String location) Return true if the specified URL should be encoded with a session identifier.
static boolean	isSchemeChar(char c) Determine if the character is allowed in the scheme of a URI.
void	setContext(ServletContext context)
void	setRequest(JSecurityHttpServletRequest request)
protected String	toEncoded(String url, String sessionId) Return the specified URL with the specified session identifier suitably encoded.

Methods inherited from class javax.servlet.http.HttpServletResponseWrapper

addCookie, addDateHeader, addHeader, addIntHeader, containsHeader, sendError, sendError, sendRedirect, setDateHeader, setHeader, setIntHeader, setStatus, setStatus

Methods inherited from class javax.servlet.ServletResponseWrapper

flushBuffer, getBufferSize, getCharacterEncoding, getContentType, getLocale, getOutputStream, getResponse, getWriter, isCommitted, reset, resetBuffer, setBufferSize, setCharacterEncoding, setContentLength, setContentType, setLocale, setResponse

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface javax.servlet.ServletResponse

flushBuffer, getBufferSize, getCharacterEncoding, getContentType, getLocale, getOutputStream, getWriter, isCommitted, reset, resetBuffer, setBufferSize, setCharacterEncoding, setContentLength, setContentType, setLocale

Constructor Detail

JSecurityHttpServletResponse

public JSecurityHttpServletResponse(HttpServletResponse wrapped,
                                    ServletContext context,
                                    JSecurityHttpServletRequest request)

Method Detail

getContext

public ServletContext getContext()

setContext

public void setContext(ServletContext context)

getRequest

public JSecurityHttpServletRequest getRequest()

setRequest

public void setRequest(JSecurityHttpServletRequest request)

encodeRedirectURL

public String encodeRedirectURL(String url)

Encode the session identifier associated with this response into the specified redirect URL, if necessary.

Specified by:

encodeRedirectURL in interface HttpServletResponse

Overrides:

encodeRedirectURL in class HttpServletResponseWrapper

Parameters:

url - URL to be encoded

encodeRedirectUrl

public String encodeRedirectUrl(String s)

Specified by:

encodeRedirectUrl in interface HttpServletResponse

Overrides:

encodeRedirectUrl in class HttpServletResponseWrapper

encodeURL

public String encodeURL(String url)

Encode the session identifier associated with this response into the specified URL, if necessary.

Specified by:

encodeURL in interface HttpServletResponse

Overrides:

encodeURL in class HttpServletResponseWrapper

Parameters:

url - URL to be encoded

encodeUrl

public String encodeUrl(String s)

Specified by:

encodeUrl in interface HttpServletResponse

Overrides:

encodeUrl in class HttpServletResponseWrapper

isEncodeable

protected boolean isEncodeable(String location)

Return true if the specified URL should be encoded with a session identifier. This will be true if all of the following conditions are met:

• The request we are responding to asked for a valid session
• The requested session ID was not received via a cookie
• The specified URL points back to somewhere within the web application that is responding to this request

Parameters:

location - Absolute URL to be validated

isSchemeChar

public static boolean isSchemeChar(char c)

Determine if the character is allowed in the scheme of a URI. See RFC 2396, Section 3.1

toEncoded

protected String toEncoded(String url,
                           String sessionId)

Return the specified URL with the specified session identifier suitably encoded.

Parameters:

url - URL to be encoded with the session id

sessionId - Session id to be included in the encoded URL