CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

allow preflight requests through OPTIONS to pass through tenant aware basic auth filter and put back enforcement on channel being HTTPS.

Browse Source
This commit is contained in:
Keith Woodlock
2012-07-14 18:05:34 +01:00
parent f186531391
commit e7b097698c
3 changed files with 22 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mifosng-provider/src/main/java/org/mifosng/platform/filters/ResponseCorsFilter.java
+1 -1
View File
@@ -17,7 +17,7 @@ public class ResponseCorsFilter implements ContainerResponseFilter {
ResponseBuilder resp = Response.fromResponse(response.getResponse()); ResponseBuilder resp = Response.fromResponse(response.getResponse());
resp.header("Access-Control-Allow-Origin", "*").header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS"); resp.header("Access-Control-Allow-Origin", "*").header("Access-Control-Expose-Headers", "X-Mifos-Platform-TenantId").header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
String reqHead = request.getHeaderValue("Access-Control-Request-Headers"); String reqHead = request.getHeaderValue("Access-Control-Request-Headers");
mifosng-provider/src/main/java/org/mifosng/platform/infrastructure/TenantAwareBasicAuthenticationFilter.java
+15 -9
View File
@@ -33,17 +33,23 @@ public class TenantAwareBasicAuthenticationFilter extends BasicAuthenticationFil
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req; HttpServletRequest request = (HttpServletRequest) req;
final String tenantId = request.getHeader(tenantRequestHeader);
if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
if (tenantId == null && exceptionIfHeaderMissing) { // ignore to allow 'preflight' requests from AJAX applications in different domain
throw new PreAuthenticatedCredentialsNotFoundException(tenantRequestHeader + " header not found in request."); } else {
final String tenantId = request.getHeader(tenantRequestHeader);
if (tenantId == null && exceptionIfHeaderMissing) {
throw new PreAuthenticatedCredentialsNotFoundException(tenantRequestHeader + " header not found in request.");
}
// check tenants database for tenantId
MifosPlatformTenant tenant = this.tenantDetailsService.loadTenantById(tenantId);
ThreadLocalContextUtil.setTenant(tenant);
} }
// check tenants database for tenantId
MifosPlatformTenant tenant = this.tenantDetailsService.loadTenantById(tenantId);
ThreadLocalContextUtil.setTenant(tenant);
super.doFilter(req, res, chain); super.doFilter(req, res, chain);
} }
} }
mifosng-provider/src/main/resources/META-INF/spring/securityContext.xml
+6 -6
View File
@@ -8,12 +8,12 @@
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd"> http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">
<http create-session="stateless" use-expressions="true" pattern="/api/**" entry-point-ref="basicAuthenticationEntryPoint"> <http create-session="stateless" use-expressions="true" pattern="/api/**" entry-point-ref="basicAuthenticationEntryPoint">
<intercept-url pattern="/api/*/authentication" access="permitAll" method="POST" requires-channel="http" /> <intercept-url pattern="/api/*/authentication" access="permitAll" method="POST" requires-channel="https" />
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="GET" requires-channel="http" /> <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="GET" requires-channel="https" />
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="POST" requires-channel="http"/> <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="POST" requires-channel="https"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="PUT" requires-channel="http"/> <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="PUT" requires-channel="https"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="DELETE" requires-channel="http"/> <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="DELETE" requires-channel="https"/>
<intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="HEAD" requires-channel="http"/> <intercept-url pattern="/api/**" access="isFullyAuthenticated()" method="HEAD" requires-channel="https"/>
<custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" /> <custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />
</http> </http>