Skip to content

Commit fd2c377

Browse files
ravishanigarapuravishanigarapu
authored
JwtToken,User-Agent validation changes (#77)
* JwtToken,User-Agent validation changes * null check
1 parent 357f765 commit fd2c377

7 files changed

Lines changed: 152 additions & 26 deletions

File tree

‎src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java‎

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@
9797
import com.iemr.admin.repository.rolemaster.M_UserservicerolemappingForRoleProviderAdminRepo;
9898
import com.iemr.admin.service.user.EncryptUserPassword;
9999
import com.iemr.admin.utils.CookieUtil;
100+
import com.iemr.admin.utils.RestTemplateUtil;
100101
import com.iemr.admin.utils.config.ConfigProperties;
101102
import com.iemr.admin.utils.exception.IEMRException;
102103
import com.iemr.admin.utils.http.HttpUtils;
@@ -462,17 +463,11 @@ private void updateSupervisorRoleInCTI(List<M_UserServiceRoleMapping2> resList1,
462463
private Set<String> getCTICampaignRoles(String campaignName, String authToken) throws JsonMappingException, JsonProcessingException {
463464
RestTemplate restTemplate = new RestTemplate();
464465
ObjectMapper objectMapper = new ObjectMapper();
465-
HttpServletRequest requestHeader = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes())
466-
.getRequest();
467-
String jwtTokenFromCookie = cookieUtil.getJwtTokenFromCookie(requestHeader);
468466
Set<String> resultSet = new HashSet<String>();
469-
MultiValueMap<String, String> headers = new LinkedMultiValueMap<String, String>();
470-
headers.add("Content-Type", "application/json");
471-
headers.add("AUTHORIZATION", authToken);
472-
headers.add("Jwttoken", jwtTokenFromCookie);
467+
HttpEntity<Object> request = RestTemplateUtil.createRequestEntity(campaignName, authToken);
473468
String url = configProperties.getPropertyByName("common-url") + configProperties.getPropertyByName("create-feedback");
474-
HttpEntity<Object> request1 = new HttpEntity<Object>(campaignName, headers);
475-
ResponseEntity<String> responseStr = restTemplate.exchange(url, HttpMethod.POST, request1, String.class);
469+
470+
ResponseEntity<String> responseStr = restTemplate.exchange(url, HttpMethod.POST, request, String.class);
476471
OutputResponse response = objectMapper.readValue(responseStr.getBody(), OutputResponse.class);
477472
if (response.isSuccess()) {
478473
JSONObject obj = new JSONObject(response.getData());
@@ -481,9 +476,6 @@ private Set<String> getCTICampaignRoles(String campaignName, String authToken) t
481476
resultSet.add(roles.getString(roleIndex));
482477
}
483478
}
484-
// JSONObject request = new JSONObject();
485-
// request.put("campaign", campaignName);
486-
487479
return resultSet;
488480
}
489481

‎src/main/java/com/iemr/admin/utils/CookieUtil.java‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,15 @@ public Optional<String> getCookieValue(HttpServletRequest request, String cookie
2323
return Optional.empty();
2424
}
2525

26-
public String getJwtTokenFromCookie(HttpServletRequest request) {
27-
return Arrays.stream(request.getCookies()).filter(cookie -> "Jwttoken".equals(cookie.getName()))
28-
.map(Cookie::getValue).findFirst().orElse(null);
26+
public static String getJwtTokenFromCookie(HttpServletRequest request) {
27+
Cookie[] cookies = request.getCookies();
28+
if (cookies == null) {
29+
return null; // No cookies present, return null safely
30+
}
31+
return Arrays.stream(cookies)
32+
.filter(cookie -> "Jwttoken".equals(cookie.getName()))
33+
.map(Cookie::getValue)
34+
.findFirst()
35+
.orElse(null);
2936
}
3037
}

‎src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
import org.slf4j.LoggerFactory;
77
import org.springframework.stereotype.Component;
88

9+
import com.iemr.admin.utils.http.AuthorizationHeaderRequestWrapper;
10+
911
import jakarta.servlet.Filter;
1012
import jakarta.servlet.FilterChain;
1113
import jakarta.servlet.ServletException;
@@ -72,25 +74,35 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
7274
if (jwtFromCookie != null) {
7375
logger.info("Validating JWT token from cookie");
7476
if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromCookie)) {
75-
filterChain.doFilter(servletRequest, servletResponse);
77+
AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper(
78+
request, "");
79+
filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse);
7680
return;
7781
}
78-
}
79-
80-
if (jwtFromHeader != null) {
82+
} else if (jwtFromHeader != null) {
8183
logger.info("Validating JWT token from header");
8284
if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromHeader)) {
83-
filterChain.doFilter(servletRequest, servletResponse);
85+
AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper(
86+
request, "");
87+
filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse);
88+
return;
89+
}
90+
} else {
91+
String userAgent = request.getHeader("User-Agent");
92+
logger.info("User-Agent: " + userAgent);
93+
if (userAgent != null && isMobileClient(userAgent) && authHeader != null) {
94+
try {
95+
UserAgentContext.setUserAgent(userAgent);
96+
filterChain.doFilter(servletRequest, servletResponse);
97+
} finally {
98+
UserAgentContext.clear();
99+
}
84100
return;
85101
}
86102
}
87-
String userAgent = request.getHeader("User-Agent");
88-
logger.info("User-Agent: " + userAgent);
89103

90-
if (userAgent != null && isMobileClient(userAgent) && authHeader != null) {
91-
filterChain.doFilter(servletRequest, servletResponse);
92-
return;
93-
}
104+
logger.warn("No valid authentication token found");
105+
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token");
94106

95107
logger.warn("No valid authentication token found");
96108
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token");

‎src/main/java/com/iemr/admin/utils/RestTemplateUtil.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
package com.iemr.admin.utils;
2+
3+
import org.slf4j.Logger;
4+
import org.slf4j.LoggerFactory;
5+
import org.springframework.http.HttpEntity;
6+
import org.springframework.http.HttpHeaders;
7+
import org.springframework.http.MediaType;
8+
import org.springframework.util.LinkedMultiValueMap;
9+
import org.springframework.util.MultiValueMap;
10+
import org.springframework.web.context.request.RequestContextHolder;
11+
import org.springframework.web.context.request.ServletRequestAttributes;
12+
13+
import jakarta.servlet.http.HttpServletRequest;
14+
15+
public class RestTemplateUtil {
16+
private final static Logger logger = LoggerFactory.getLogger(RestTemplateUtil.class);
17+
18+
public static HttpEntity<Object> createRequestEntity(Object body, String authorization) {
19+
20+
ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes());
21+
if (servletRequestAttributes == null) {
22+
MultiValueMap<String, String> headers = new LinkedMultiValueMap<>();
23+
headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8");
24+
headers.add(HttpHeaders.AUTHORIZATION, authorization);
25+
return new HttpEntity<>(body, headers);
26+
}
27+
HttpServletRequest requestHeader = servletRequestAttributes.getRequest();
28+
String jwtTokenFromCookie = null;
29+
try {
30+
jwtTokenFromCookie = CookieUtil.getJwtTokenFromCookie(requestHeader);
31+
32+
} catch (Exception e) {
33+
logger.error("Error while getting jwtToken from Cookie" + e.getMessage() );
34+
}
35+
36+
MultiValueMap<String, String> headers = new LinkedMultiValueMap<>();
37+
headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8");
38+
if(null != UserAgentContext.getUserAgent()) {
39+
headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent());
40+
}
41+
headers.add(HttpHeaders.AUTHORIZATION, authorization);
42+
headers.add("JwtToken",requestHeader.getHeader("JwtToken"));
43+
if(null != jwtTokenFromCookie) {
44+
headers.add(HttpHeaders.COOKIE, "Jwttoken=" + jwtTokenFromCookie);
45+
}
46+
47+
return new HttpEntity<>(body, headers);
48+
}
49+
50+
}

‎src/main/java/com/iemr/admin/utils/UserAgentContext.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
package com.iemr.admin.utils;
2+
3+
public class UserAgentContext {
4+
private static final ThreadLocal<String> userAgentHolder = new ThreadLocal<>();
5+
6+
public static void setUserAgent(String userAgent) {
7+
userAgentHolder.set(userAgent);
8+
}
9+
10+
public static String getUserAgent() {
11+
return userAgentHolder.get();
12+
}
13+
14+
public static void clear() {
15+
userAgentHolder.remove();
16+
}
17+
18+
}

‎src/main/java/com/iemr/admin/utils/http/AuthorizationHeaderRequestWrapper.java‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package com.iemr.admin.utils.http;
2+
3+
import java.util.Collections;
4+
import java.util.Enumeration;
5+
import java.util.List;
6+
7+
import jakarta.servlet.http.HttpServletRequest;
8+
import jakarta.servlet.http.HttpServletRequestWrapper;
9+
10+
public class AuthorizationHeaderRequestWrapper extends HttpServletRequestWrapper{
11+
private final String Authorization;
12+
13+
public AuthorizationHeaderRequestWrapper(HttpServletRequest request, String authHeaderValue) {
14+
super(request);
15+
this.Authorization = authHeaderValue;
16+
}
17+
18+
@Override
19+
public String getHeader(String name) {
20+
if ("Authorization".equalsIgnoreCase(name)) {
21+
return Authorization;
22+
}
23+
return super.getHeader(name);
24+
}
25+
26+
@Override
27+
public Enumeration<String> getHeaders(String name) {
28+
if ("Authorization".equalsIgnoreCase(name)) {
29+
return Collections.enumeration(Collections.singletonList(Authorization));
30+
}
31+
return super.getHeaders(name);
32+
}
33+
34+
@Override
35+
public Enumeration<String> getHeaderNames() {
36+
List<String> names = Collections.list(super.getHeaderNames());
37+
if (!names.contains("Authorization")) {
38+
names.add("Authorization");
39+
}
40+
return Collections.enumeration(names);
41+
}
42+
}
43+

‎src/main/java/com/iemr/admin/utils/http/HTTPRequestInterceptor.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,10 @@ public boolean preHandle(HttpServletRequest request, HttpServletResponse respons
6060
authorization=preAuth.replace("Bearer ", "");
6161
else
6262
authorization = preAuth;
63+
if (authorization == null || authorization.isEmpty()) {
64+
logger.info("Authorization header is null or empty. Skipping HTTPRequestInterceptor.");
65+
return true; // Allow the request to proceed without validation
66+
}
6367
if (!request.getMethod().equalsIgnoreCase("OPTIONS")) {
6468
try {
6569
String[] requestURIParts = request.getRequestURI().split("/");

0 commit comments

Comments
 (0)