Shiro filter without redirection
I have a REST frontend that is called from Front-End code via jquery-Ajax-Requests. The called url is pinned like this:
/api/** = authc
If the user is not authenticated, Shiro wants to redirect the login url and ajax-Request will not be able to process it. I would prefer HTML status code as a response. What's the best way to achieve this? Thanks for any answers!
+3
source to share
1 answer
You need to implement your own shiro filter. Something like that:
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.IOException ;
import javax.servlet.http.HttpServletResponse ;
import org.apache.shiro.web.filter.authz.AuthorizationFilter ;
import org.apache.shiro.web.util.WebUtils ;
public class LocalhostFilter extends AuthorizationFilter {
private static final String message = "Access denied.";
@Override
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
//do something when access allowed
return true;
}
@Override
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws IOException {
HttpServletResponse httpResponse ;
try { httpResponse = WebUtils.toHttp(response); }
catch (ClassCastException ex) {
// Not a HTTP Servlet operation
return super.onAccessDenied(request, response) ;
}
if ( message == null )
httpResponse.sendError(403) ;
else
httpResponse.sendError(403, message) ;
return false ; // No further processing.
}
}
+4
source to share