Spring OAuth2 Auth Server: a specific /oauth/token filter?

Question

I am currently checking all the incoming Authorization headers for JWT token values so that I can check if those tokens are blacklisted. I have implemented a custom Filter for this.

The problem is that this filter is handling all the requests that are coming into the server. I'd like to handle only the requests that are coming to the /oauth/token endpoint.

Is it possible to implement that in Spring OAuth2 Auth Server?

And when you say "filter out" does that mean you want your Filter to ignore requests to '/oauth/token' or those are the ones you trying to block? — Jose Martinez
– Jose Martinez, Commented Apr 24, 2018 at 12:44
@JoseMartinez sorry, I phrased it incorrectly. I want to handle only the requests that are incoming to oauth/token endpoint. — Deniss M.
– Deniss M., Commented Apr 24, 2018 at 12:46

Jose Martinez · Accepted Answer · 2018-04-24 12:52:57Z

6

There are two aspects to your question, one is Filter order and two is only filtering a specific URL path. Both can be tackled by using a FilterRegistrationBean to inject your filter. See example below.

@Bean
public FilterRegistrationBean securityFilter() {
    Filter f = new MySecurityFilter();
    FilterRegistrationBean frb = new FilterRegistrationBean(f);
    frb.setOrder(SecurityProperties.ACCESS_OVERRIDE_ORDER);
    frb.setUrlPatterns(Arrays.asList("/oauth/token"));
    return frb;
}

answered Apr 24, 2018 at 12:52

Jose Martinez

12.1k7 gold badges57 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Oreste Viron · Accepted Answer · 2018-04-24 12:42:26Z

1

It's a question of priority of your filter. Add :

@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)

To your WebSecurityConfiguration should help you.

answered Apr 24, 2018 at 12:42

Oreste Viron

3,7954 gold badges27 silver badges39 bronze badges

Comments

Tom · Accepted Answer · 2018-04-24 12:50:04Z

1

In the case your custom filter extends the OncePerRequestFilter you can override the shouldNotFilter method.

@Override
protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
    return !new AntPathMatcher().match("/oauth/token", request.getServletPath());
}

From the Doc

Can be overridden in subclasses for custom filtering control, returning true to avoid filtering of the given request.

answered Apr 24, 2018 at 12:50

Tom

1,02712 silver badges18 bronze badges

1 Comment

Deniss M. Over a year ago

The custom filter itself is implementing the Filter interface.

Collectives™ on Stack Overflow

Spring OAuth2 Auth Server: a specific /oauth/token filter?

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related