CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 64 Packages Projects Releases Wiki Activity

allow preflight requests through OPTIONS to pass through tenant aware basic auth filter and put back enforcement on channel being HTTPS.

Browse Source
This commit is contained in:
Keith Woodlock
2012-07-14 18:05:34 +01:00
parent f186531391
commit e7b097698c
3 changed files with 22 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mifosng-provider/src/main/java/org/mifosng/platform/filters/ResponseCorsFilter.java
+1 -1
View File
@@ -17,7 +17,7 @@ public class ResponseCorsFilter implements ContainerResponseFilter {
ResponseBuilder resp = Response.fromResponse(response.getResponse());
resp.header("Access-Control-Allow-Origin", "*").header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
resp.header("Access-Control-Allow-Origin", "*").header("Access-Control-Expose-Headers", "X-Mifos-Platform-TenantId").header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
String reqHead = request.getHeaderValue("Access-Control-Request-Headers");
mifosng-provider/src/main/java/org/mifosng/platform/infrastructure/TenantAwareBasicAuthenticationFilter.java
+15 -9
View File
@@ -33,17 +33,23 @@ public class TenantAwareBasicAuthenticationFilter extends BasicAuthenticationFil
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
final String tenantId = request.getHeader(tenantRequestHeader);
if (tenantId == null && exceptionIfHeaderMissing) {
throw new PreAuthenticatedCredentialsNotFoundException(tenantRequestHeader + " header not found in request.");
if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
// ignore to allow 'preflight' requests from AJAX applications in different domain
} else {
final String tenantId = request.getHeader(tenantRequestHeader);
if (tenantId == null && exceptionIfHeaderMissing) {
throw new PreAuthenticatedCredentialsNotFoundException(tenantRequestHeader + " header not found in request.");
}
// check tenants database for tenantId
MifosPlatformTenant tenant = this.tenantDetailsService.loadTenantById(tenantId);
ThreadLocalContextUtil.setTenant(tenant);
}
// check tenants database for tenantId
MifosPlatformTenant tenant = this.tenantDetailsService.loadTenantById(tenantId);
ThreadLocalContextUtil.setTenant(tenant);
super.doFilter(req, res, chain);
}
}
mifosng-provider/src/main/resources/META-INF/spring/securityContext.xml
+6 -6
View File
@@ -8,12 +8,12 @@
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">
<http create-session="stateless" use-expressions="true" pattern="/api/**" entry-point-ref="basicAuthenticationEntryPoint">
<intercept-url pattern="/api/*/authentication" access="permitAll" method="POST" requires-channel="http" />
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="GET" requires-channel="http" />
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="POST" requires-channel="http"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="PUT" requires-channel="http"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="DELETE" requires-channel="http"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="HEAD" requires-channel="http"/>
<intercept-url pattern="/api/*/authentication" access="permitAll" method="POST" requires-channel="https" />
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="GET" requires-channel="https" />
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="POST" requires-channel="https"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="PUT" requires-channel="https"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="DELETE" requires-channel="https"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="HEAD" requires-channel="https"/>
<custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />
</http>