For any web application, 2 type of checks are very important.
Authentication: Is this the right user? Can he access the system? Does he has right credentials?
Authorization: Now we know that user has access to the system, but does he has access to given resource. For example, a normal user should not be able to add or delete another user from the system, only admin (has authority) should be able to do this.
How can we implement Authorization and Authentication checks in Java?
The answer is through filters. Actually you can add checks in your controllers of inside the application, but it is easier to implement url based Authentication through filters.
For authentication, it is easier. Just add a filter on any incoming request, and inside the filter check if a valid session is set for the user (Assuming that we set a session for user as soon as he logs in).
<filter-mapping> <filter-name>AuthenticationFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
In AutheticationFilter (Assuming you are setting session “user”)
//add a check somewhere
// Getting the current user information
MyUser myUser = (MyUser) session.getAttribute("user");
if (myUser == null) {
return null;
}
return myUser;
One we have authenticated the user, we need to know if the user is actually authorized to do the action he has requested. In this case we will tackle this through url being triggered by user and validate if the user has access to the url.
<filter-mapping> <filter-name>AuthorizationFilter</filter-name> <url-pattern>/admin/*</url-pattern> </filter-mapping>
Any url that starts with /admin, will need to get authorized through this. Now similar to AuthenticationFilter, my authorization filter will first read user from session, then fetch role for user. You will need to keep a mapping of roles that have a permission for a url. Or you can add it to web.xml where you are defining AuthorizationFilter.
<filter> <filter-name>AuthorizationFilter</filter-name> <filter-class>com.test.filters.AuthorizationFilter</filter-class> <init-param> <param-name>rolesAllowed</param-name> <param-value>ADMIN, SUPERADMIN</param-value> </init-param> </filter>