org.springframework.web.servlet.handler

Class UserRoleAuthorizationInterceptor

java.lang.Object

org.springframework.web.servlet.handler.HandlerInterceptorAdapter

org.springframework.web.servlet.handler.UserRoleAuthorizationInterceptor

All Implemented Interfaces:

AsyncHandlerInterceptor, HandlerInterceptor

public class UserRoleAuthorizationInterceptor
extends HandlerInterceptorAdapter

Interceptor that checks the authorization of the current user via the user's roles, as evaluated by HttpServletRequest's isUserInRole method.

Since:

20.06.2003

Author:

Juergen Hoeller

See Also:

HttpServletRequest.isUserInRole(java.lang.String)

Constructor Summary

Constructors

Constructor and Description
UserRoleAuthorizationInterceptor()

Method Summary

Modifier and Type	Method and Description
protected void	handleNotAuthorized(HttpServletRequest request, HttpServletResponse response, Object handler) Handle a request that is not authorized according to this interceptor.
boolean	preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) This implementation always returns true.
void	setAuthorizedRoles(String... authorizedRoles) Set the roles that this interceptor should treat as authorized.

Methods inherited from class org.springframework.web.servlet.handler.HandlerInterceptorAdapter

afterCompletion, afterConcurrentHandlingStarted, postHandle

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

UserRoleAuthorizationInterceptor

public UserRoleAuthorizationInterceptor()

Method Detail

setAuthorizedRoles

public final void setAuthorizedRoles(String... authorizedRoles)

Set the roles that this interceptor should treat as authorized.

Parameters:

authorizedRoles - array of role names

preHandle

public final boolean preHandle(HttpServletRequest request,
                               HttpServletResponse response,
                               Object handler)
                        throws ServletException,
                               IOException

Description copied from class: HandlerInterceptorAdapter

This implementation always returns true.

Specified by:

preHandle in interface HandlerInterceptor

Overrides:

preHandle in class HandlerInterceptorAdapter

Parameters:

request - current HTTP request

response - current HTTP response

handler - chosen handler to execute, for type and/or instance evaluation

Returns:

true if the execution chain should proceed with the next interceptor or the handler itself. Else, DispatcherServlet assumes that this interceptor has already dealt with the response itself.

Throws:

ServletException

IOException

handleNotAuthorized

protected void handleNotAuthorized(HttpServletRequest request,
                                   HttpServletResponse response,
                                   Object handler)
                            throws ServletException,
                                   IOException

Handle a request that is not authorized according to this interceptor. Default implementation sends HTTP status code 403 ("forbidden").

This method can be overridden to write a custom message, forward or redirect to some error page or login page, or throw a ServletException.

Parameters:

request - current HTTP request

response - current HTTP response

handler - chosen handler to execute, for type and/or instance evaluation

Throws:

ServletException - if there is an internal error

IOException - in case of an I/O error when writing the response