From e7b097698c84bc1046f39a9a5403ab44cbecafc1 Mon Sep 17 00:00:00 2001
From: Keith Woodlock <keithwoodlock@gmail.com>
Date: Sat, 14 Jul 2012 18:05:34 +0100
Subject: [PATCH] allow preflight requests through OPTIONS to pass through
 tenant aware basic auth filter and put back enforcement on channel being
 HTTPS.

---
 .../platform/filters/ResponseCorsFilter.java  |  2 +-
 .../TenantAwareBasicAuthenticationFilter.java | 24 ++++++++++++-------
 .../META-INF/spring/securityContext.xml       | 12 +++++-----
 3 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/filters/ResponseCorsFilter.java b/mifosng-provider/src/main/java/org/mifosng/platform/filters/ResponseCorsFilter.java
index 6953eed1c..6ab001603 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/filters/ResponseCorsFilter.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/filters/ResponseCorsFilter.java
@@ -17,7 +17,7 @@ public class ResponseCorsFilter implements ContainerResponseFilter {
 
 		ResponseBuilder resp = Response.fromResponse(response.getResponse());
 		
-		resp.header("Access-Control-Allow-Origin", "*").header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+		resp.header("Access-Control-Allow-Origin", "*").header("Access-Control-Expose-Headers", "X-Mifos-Platform-TenantId").header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 
 		String reqHead = request.getHeaderValue("Access-Control-Request-Headers");
 
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/infrastructure/TenantAwareBasicAuthenticationFilter.java b/mifosng-provider/src/main/java/org/mifosng/platform/infrastructure/TenantAwareBasicAuthenticationFilter.java
index 04fb8522a..a466e59be 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/infrastructure/TenantAwareBasicAuthenticationFilter.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/infrastructure/TenantAwareBasicAuthenticationFilter.java
@@ -33,17 +33,23 @@ public class TenantAwareBasicAuthenticationFilter extends BasicAuthenticationFil
 	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
 		
 		HttpServletRequest request = (HttpServletRequest) req;
-		final String tenantId = request.getHeader(tenantRequestHeader);
-
-		if (tenantId == null && exceptionIfHeaderMissing) {
-			throw new PreAuthenticatedCredentialsNotFoundException(tenantRequestHeader + " header not found in request.");
+		
+		if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
+			// ignore to allow 'preflight' requests from AJAX applications in different domain
+		} else {
+		
+			final String tenantId = request.getHeader(tenantRequestHeader);
+	
+			if (tenantId == null && exceptionIfHeaderMissing) {
+				throw new PreAuthenticatedCredentialsNotFoundException(tenantRequestHeader + " header not found in request.");
+			}
+			
+			// check tenants database for tenantId
+			MifosPlatformTenant tenant = this.tenantDetailsService.loadTenantById(tenantId);
+			
+			ThreadLocalContextUtil.setTenant(tenant);
 		}
 		
-		// check tenants database for tenantId
-		MifosPlatformTenant tenant = this.tenantDetailsService.loadTenantById(tenantId);
-		
-		ThreadLocalContextUtil.setTenant(tenant);
-		
 		super.doFilter(req, res, chain);
 	}
 }
\ No newline at end of file
diff --git a/mifosng-provider/src/main/resources/META-INF/spring/securityContext.xml b/mifosng-provider/src/main/resources/META-INF/spring/securityContext.xml
index 6631dd988..b67e20e44 100644
--- a/mifosng-provider/src/main/resources/META-INF/spring/securityContext.xml
+++ b/mifosng-provider/src/main/resources/META-INF/spring/securityContext.xml
@@ -8,12 +8,12 @@
    http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">
 
 	<http create-session="stateless" use-expressions="true" pattern="/api/**" entry-point-ref="basicAuthenticationEntryPoint">
-	   <intercept-url pattern="/api/*/authentication" access="permitAll" method="POST" requires-channel="http" />
-	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="GET" requires-channel="http" />
-	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="POST" requires-channel="http"/>
-	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="PUT" requires-channel="http"/>
-	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="DELETE" requires-channel="http"/>
-	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="HEAD" requires-channel="http"/>
+	   <intercept-url pattern="/api/*/authentication" access="permitAll" method="POST" requires-channel="https" />
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="GET" requires-channel="https" />
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="POST" requires-channel="https"/>
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="PUT" requires-channel="https"/>
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="DELETE" requires-channel="https"/>
+	   <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="HEAD" requires-channel="https"/>
 
 		<custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />	   
 	</http>