{"id":740,"date":"2012-02-19T18:27:44","date_gmt":"2012-02-19T17:27:44","guid":{"rendered":"http:\/\/doanduyhai.wordpress.com\/?p=740"},"modified":"2012-02-19T18:27:44","modified_gmt":"2012-02-19T17:27:44","slug":"spring-security-part-iv-exceptiontranslationfilter-filtersecurityinterceptor","status":"publish","type":"post","link":"https:\/\/www.doanduyhai.com\/blog\/?p=740","title":{"rendered":"Spring Security part IV : ExceptionTranslationFilter & FilterSecurityInterceptor"},"content":{"rendered":"

In this post we’ll examine in depth the ExceptionTranslationFilter<\/strong> and FilterSecurityInterceptor<\/strong> filters<\/p>\n

<\/p>\n

VII ExceptionTranslationFilter<\/h1>\n
\n&lt;!-- Filter to redirect to login page --&gt;\n&lt;bean id=&quot;exceptionTranslationFilter&quot; class=&quot;org.springframework.security.web.access.ExceptionTranslationFilter&quot;&gt;\n        &lt;property name=&quot;authenticationEntryPoint&quot; ref=&quot;authenticationEntryPoint&quot;\/&gt;\n        &lt;property name=&quot;accessDeniedHandler&quot; ref=&quot;accessDeniedHandler&quot;\/&gt;\n&lt;\/bean&gt;\n    \n&lt;bean id=&quot;authenticationEntryPoint&quot;  class=&quot;org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint&quot;&gt;\n\t  &lt;property name=&quot;loginFormUrl&quot; value=&quot;\/pages\/Security\/login.html&quot;\/&gt;\n\t  &lt;property name=&quot;forceHttps&quot; value=&quot;false&quot;\/&gt;\n&lt;\/bean&gt;\n    \n&lt;bean id=&quot;accessDeniedHandler&quot; class=&quot;org.springframework.security.web.access.AccessDeniedHandlerImpl&quot;&gt;\n\t&lt;property name=&quot;errorPage&quot; value=&quot;\/pages\/Security\/accessDenied.html&quot;\/&gt;\n&lt;\/bean&gt;\n<\/pre>\n
1) ExceptionTranslationFilter<\/h4>\n
The ExceptionTranslationFilter<\/strong> purpose is to redirect the user to the login page if he’s not yet authenticated and to a default error page if he tries to access an unauthorized resources.<\/p>\n
The authenticationEntryPoint<\/strong> defines a loginFormUrl<\/em> pointing to the default login page. Optionally you can force usage of HTTPS by setting forceHttps<\/em> to true<\/strong>.<\/p>\n
Your login page should resemble:<\/p>\n
\n&lt;form action=&quot;myApplication\/j_myApplication_security_check&quot; method=&quot;post&quot;&gt;\n\t&lt;fieldset&gt;\n\t\t&lt;legend&gt;Login form&lt;\/legend&gt;\n\t\t&lt;label for=&quot;j_username&quot;&gt;Login&lt;\/label&gt;\n\t\t&lt;input type=&quot;text&quot; id=&quot;j_username&quot; size=&quot;20&quot;\/&gt;\n\n\t\t&lt;label for=&quot;j_password&quot;&gt;Password&lt;\/label&gt;\n\t\t&lt;input type=&quot;password&quot; id=&quot;j_password&quot; size=&quot;20&quot;\/&gt;\n\t\t\t\n\t\t&lt;button type=&quot;submit&quot;&gt;Submit&lt;\/button&gt;\n\t\t&lt;button type=&quot;reset&quot;&gt;Reset&lt;\/button&gt;\n\t&lt;\/fieldset&gt;\t\t\n&lt;\/form&gt;\n<\/pre>\n
Remember about the filterProcessesUrl<\/em> parameter we mentionned in the previous post ? It is used here as default action for the login form.<\/p>\n
 For Spring Security to retrieve the login & password values in the HTTP request attributes, we should set their ids to “j_username<\/em>” & “j_password<\/em>” respectively. This is the default convention<\/strong>.<\/p>\n
 Again it is possible to change these defaults by setting the “usernameParameter<\/em>” & “passwordParameter<\/em>” for the authenticationProcessingFilter<\/strong>.<\/p>\n
\n&lt;bean id=&quot;authenticationProcessingFilter&quot; class=&quot;org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter&quot;&gt;\n\t&lt;property name=&quot;authenticationManager&quot; ref=&quot;authenticationManager&quot;\/&gt;\n\t&lt;property name=&quot;usernameParameter&quot; value=&quot;j_myUserNameId&quot;\/&gt;\n\t&lt;property name=&quot;passwordParameter&quot; value=&quot;j_myPasswordId&quot;\/&gt;\n\t&lt;property name=&quot;filterProcessesUrl&quot; value=&quot;\/j_myApplication_security_check&quot;\/&gt;\n\t...\n&lt;\/bean&gt;\n<\/pre>\n
 <\/p>\n
2) AccessDeniedHandler<\/h4>\n
This handler simply forwards the user to the error page defined by the “errorPage<\/em>” parameter if he is not authorized to access the requested resources, quite straightforward.<\/p>\n
 <\/p>\n
VIII FilterSecurityInterceptor<\/h1>\n
The core of access management is done by this filter.
\n First, the namespace for Spring security should be set in order to use the shorthand “sec<\/em>“.<\/p>\n
\n&lt;beans xmlns=&quot;http:\/\/www.springframework.org\/schema\/beans&quot;\n\txmlns:xsi=&quot;http:\/\/www.w3.org\/2001\/XMLSchema-instance&quot;\n \txmlns:sec=&quot;http:\/\/www.springframework.org\/schema\/security&quot;\n\txsi:schemaLocation=&quot;http:\/\/www.springframework.org\/schema\/beans http:\/\/www.springframework.org\/schema\/beans\/spring-beans-3.0.xsd\n\t\thttp:\/\/www.springframework.org\/schema\/security http:\/\/www.springframework.org\/schema\/security\/spring-security-3.0.xsd&quot;&gt;\n<\/pre>\n
1) <sec:filter-security-metadata-source><\/h4>\n
\n&lt;!-- Filter for role checking --&gt;\n&lt;bean id=&quot;filterSecurityInterceptor&quot; class=&quot;org.springframework.security.web.access.intercept.FilterSecurityInterceptor&quot;&gt;\n\t&lt;property name=&quot;authenticationManager&quot; ref=&quot;authenticationManager&quot;\/&gt;\n\t&lt;property name=&quot;accessDecisionManager&quot; ref=&quot;httpRequestAccessDecisionManager&quot;\/&gt;\n\t&lt;property name=&quot;securityMetadataSource&quot;&gt;\n\t\t&lt;sec:filter-security-metadata-source lowercase-comparisons=&quot;true&quot; request-matcher=&quot;ant&quot; use-expressions=&quot;true&quot;&gt;\n\t\t\t&lt;sec:intercept-url pattern=&quot;\/pages\/Security\/**&quot; access=&quot;permitAll&quot;\/&gt;\n\t\t\t&lt;sec:intercept-url pattern=&quot;\/resources\/**&quot; access=&quot;permitAll&quot;\/&gt;\n\t\t\t&lt;sec:intercept-url pattern=&quot;\/pages\/Settings\/**&quot; access=&quot;hasRole('SETTINGS')&quot;\/&gt;\n\t\t\t&lt;sec:intercept-url pattern=&quot;\/pages\/Home\/*&quot; access=&quot;hasRole('HOME')&quot;\/&gt;              \n\t\t\t&lt;sec:intercept-url pattern=&quot;\/pages\/Admin\/**&quot; access=&quot;hasRole('ADMINISTRATOR')&quot;\/&gt;\n\t\t\t&lt;sec:intercept-url pattern=&quot;\/servlet\/Download&quot; access=&quot;hasAnyRole('DOWNLOAD','PREMIUM_ACCOUNT')&quot;\/&gt;\n                \n\t\t\t&lt;sec:intercept-url pattern=&quot;\/**&quot; access=&quot;isAuthenticated()&quot;\/&gt;\n\t\t&lt;\/sec:filter-security-metadata-source&gt;\n\t&lt;\/property&gt;\n&lt;\/bean&gt;\n<\/pre>\n
Lots of interesting points to mention here.<\/p>\n
We define inside the <filter-security-metadata-source><\/strong> tag a list of resource URLs and the corresponding roles to access them. This tag exposes the following attributes:<\/p>\n