Source code: org/acegisecurity/securechannel/InsecureChannelProcessor.java
1 /* Copyright 2004 Acegi Technology Pty Limited
2 *
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 package org.acegisecurity.securechannel;
17
18 import org.acegisecurity.ConfigAttribute;
19 import org.acegisecurity.ConfigAttributeDefinition;
20 import org.acegisecurity.intercept.web.FilterInvocation;
21
22 import org.springframework.beans.factory.InitializingBean;
23 import org.springframework.util.Assert;
24
25 import java.io.IOException;
26
27 import java.util.Iterator;
28
29 import javax.servlet.ServletException;
30
31
32 /**
33 * <p>
34 * Ensures channel security is inactive by review of
35 * <code>HttpServletRequest.isSecure()</code> responses.
36 * </p>
37 *
38 * <P>
39 * The class responds to one case-sensitive keyword, {@link
40 * #getInsecureKeyword}. If this keyword is detected,
41 * <code>HttpServletRequest.isSecure()</code> is used to determine the channel
42 * security offered. If channel security is present, the configured
43 * <code>ChannelEntryPoint</code> is called. By default the entry point is
44 * {@link RetryWithHttpEntryPoint}.
45 * </p>
46 *
47 * <P>
48 * The default <code>insecureKeyword</code> is
49 * <code>REQUIRES_INSECURE_CHANNEL</code>.
50 * </p>
51 *
52 * @author Ben Alex
53 * @version $Id: InsecureChannelProcessor.java,v 1.3 2005/11/17 00:55:50 benalex Exp $
54 */
55 public class InsecureChannelProcessor implements InitializingBean,
56 ChannelProcessor {
57 //~ Instance fields ========================================================
58
59 private ChannelEntryPoint entryPoint = new RetryWithHttpEntryPoint();
60 private String insecureKeyword = "REQUIRES_INSECURE_CHANNEL";
61
62 //~ Methods ================================================================
63
64 public void setEntryPoint(ChannelEntryPoint entryPoint) {
65 this.entryPoint = entryPoint;
66 }
67
68 public ChannelEntryPoint getEntryPoint() {
69 return entryPoint;
70 }
71
72 public void setInsecureKeyword(String secureKeyword) {
73 this.insecureKeyword = secureKeyword;
74 }
75
76 public String getInsecureKeyword() {
77 return insecureKeyword;
78 }
79
80 public void afterPropertiesSet() throws Exception {
81 Assert.hasLength(insecureKeyword, "insecureKeyword required");
82 Assert.notNull(entryPoint, "entryPoint required");
83 }
84
85 public void decide(FilterInvocation invocation,
86 ConfigAttributeDefinition config) throws IOException, ServletException {
87 if ((invocation == null) || (config == null)) {
88 throw new IllegalArgumentException("Nulls cannot be provided");
89 }
90
91 Iterator iter = config.getConfigAttributes();
92
93 while (iter.hasNext()) {
94 ConfigAttribute attribute = (ConfigAttribute) iter.next();
95
96 if (supports(attribute)) {
97 if (invocation.getHttpRequest().isSecure()) {
98 entryPoint.commence(invocation.getRequest(),
99 invocation.getResponse());
100 }
101 }
102 }
103 }
104
105 public boolean supports(ConfigAttribute attribute) {
106 if ((attribute != null) && (attribute.getAttribute() != null)
107 && attribute.getAttribute().equals(getInsecureKeyword())) {
108 return true;
109 } else {
110 return false;
111 }
112 }
113 }