org.springframework.security.ui
Class ExceptionTranslationFilter

java.lang.Object
  org.springframework.security.ui.SpringSecurityFilter
      org.springframework.security.ui.ExceptionTranslationFilter

All Implemented Interfaces:

Filter, InitializingBean, Ordered

public class ExceptionTranslationFilter
extends SpringSecurityFilter
implements InitializingBean

Handles any AccessDeniedException and AuthenticationException thrown within the filter chain.

This filter is necessary because it provides the bridge between Java exceptions and HTTP responses. It is solely concerned with maintaining the user interface. This filter does not do any actual security enforcement.

If an AuthenticationException is detected, the filter will launch the authenticationEntryPoint. This allows common handling of authentication failures originating from any subclass of AbstractSecurityInterceptor.

If an AccessDeniedException is detected, the filter will determine whether or not the user is an anonymous user. If they are an anonymous user, the authenticationEntryPoint will be launched. If they are not an anonymous user, the filter will delegate to the AccessDeniedHandler. By default the filter will use AccessDeniedHandlerImpl.

To use this filter, it is necessary to specify the following properties:

• authenticationEntryPoint indicates the handler that should commence the authentication process if an AuthenticationException is detected. Note that this may also switch the current protocol from http to https for an SSL login.
• portResolver is used to determine the "real" port that a request was received on.

Version:

$Id$

Author:

Ben Alex, colin sampaleanu

Field Summary

Fields inherited from class org.springframework.security.ui.SpringSecurityFilter

logger

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

ExceptionTranslationFilter()

Method Summary

void	afterPropertiesSet()
void	doFilterHttp(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
AuthenticationEntryPoint	getAuthenticationEntryPoint()
AuthenticationTrustResolver	getAuthenticationTrustResolver()
int	getOrder()
PortResolver	getPortResolver()
boolean	isCreateSessionAllowed() If true, indicates that SecurityEnforcementFilter is permitted to store the target URL and exception information in the HttpSession (the default).
protected void	sendStartAuthentication(ServletRequest request, ServletResponse response, FilterChain chain, AuthenticationException reason)
void	setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler)
void	setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)
void	setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)
void	setCreateSessionAllowed(boolean createSessionAllowed)
void	setPortResolver(PortResolver portResolver)
void	setThrowableAnalyzer(ThrowableAnalyzer throwableAnalyzer)

Methods inherited from class org.springframework.security.ui.SpringSecurityFilter

destroy, doFilter, init, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

ExceptionTranslationFilter

public ExceptionTranslationFilter()

Method Detail

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface InitializingBean

Throws:

Exception

doFilterHttp

public void doFilterHttp(HttpServletRequest request,
                         HttpServletResponse response,
                         FilterChain chain)
                  throws IOException,
                         ServletException

Specified by:

doFilterHttp in class SpringSecurityFilter

Throws:

IOException

ServletException

getAuthenticationEntryPoint

public AuthenticationEntryPoint getAuthenticationEntryPoint()

getAuthenticationTrustResolver

public AuthenticationTrustResolver getAuthenticationTrustResolver()

getPortResolver

public PortResolver getPortResolver()

isCreateSessionAllowed

public boolean isCreateSessionAllowed()

If true, indicates that SecurityEnforcementFilter is permitted to store the target URL and exception information in the HttpSession (the default). In situations where you do not wish to unnecessarily create HttpSessions - because the user agent will know the failed URL, such as with BASIC or Digest authentication - you may wish to set this property to false. Remember to also set the HttpSessionContextIntegrationFilter.allowSessionCreation to false if you set this property to false.

Returns:

true if the HttpSession will be used to store information about the failed request, false if the HttpSession will not be used

sendStartAuthentication

protected void sendStartAuthentication(ServletRequest request,
                                       ServletResponse response,
                                       FilterChain chain,
                                       AuthenticationException reason)
                                throws ServletException,
                                       IOException

Throws:

ServletException

IOException

setAccessDeniedHandler

public void setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler)

setAuthenticationEntryPoint

public void setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint)

setAuthenticationTrustResolver

public void setAuthenticationTrustResolver(AuthenticationTrustResolver authenticationTrustResolver)

setCreateSessionAllowed

public void setCreateSessionAllowed(boolean createSessionAllowed)

setPortResolver

public void setPortResolver(PortResolver portResolver)

setThrowableAnalyzer

public void setThrowableAnalyzer(ThrowableAnalyzer throwableAnalyzer)

getOrder

public int getOrder()

Specified by:

getOrder in interface Ordered