public class HttpBasicAuthFilter extends GenericFilter
If challenged for authentication via a
401 Unauthorized status code by the server,
this filter will retry the request with credentials attached. Therefore, the request entity
will be branched and stored for the duration of the exchange.
Once an HTTP authentication challenge (status code 401) is issued from the remote server, all subsequent requests to that remote server that pass through the filter will include the user credentials.
Credentials are cached in the session to allow subsequent requests to automatically include
authentication credentials. If authentication fails (including the case of no credentials
yielded from the
password expressions, then the exchange is diverted
to the authentication failure handler.
|Modifier and Type||Class and Description|
Creates and initializes an HTTP basic authentication filter in a heap environment.
|Constructor and Description|
|Modifier and Type||Method and Description|
Filters the request and/or response of an exchange.
Decide if we cache the password header result (defaults to true).
public HttpBasicAuthFilter(Expression username, Expression password, Handler failureHandler)
HttpBasicAuthFilterwith required expressions and error handler.
username- the expression that yields the username to supply during authentication.
password- the expression that yields the password to supply during authentication.
failureHandler- the Handler to dispatch to if authentication fails.
public void setCacheHeader(boolean cacheHeader)
cacheHeader- cache (or not) the Authorization header
public void filter(Exchange exchange, Handler next) throws HandlerException, IOException
exchange.requestcontains the request to be filtered. To pass the request to the next filter or handler in the chain, the filter calls
next.handle(exchange). After this call,
exchange.responsecontains the response that can be filtered.
This method may elect not to pass the request to the next filter or handler, and instead
handle the request itself. It can achieve this by merely avoiding a call to
next.handle(exchange) and creating its own response object the exchange. The
filter is also at liberty to replace a response with another of its own after the call
Important note: If an existing response exists in the exchange object
and the filter intends to replace it with its own, it must first check to see if the
existing response has an entity, and if it does, must call its
close method in
order to signal that the processing of the response from a remote server is complete.
Copyright © 2014 ForgeRock AS. All rights reserved.