I want to authenticate according to url's params

[creatxr]

I want to authenticate according to url's params

what do I?

for example

userA

can visit url xxx?param1=0
can't visit url xxx?param1=3

what must I do?
use acl????

[Ben Alex]

PathBasedFilterInvocationDefinitionMap and RegExpBasedFilterInvocationDefinitionMap both use AbstractFilterInvocationDefinitionSource's getAttribute(Object) method. It looks like this:

    public ConfigAttributeDefinition getAttributes(Object object)
        throws IllegalArgumentException {
        if ((object == null) || !this.supports(object.getClass())) {
            throw new IllegalArgumentException(
                "Object must be a FilterInvocation");
        }

        String url = ((FilterInvocation) object).getRequestUrl();

        return this.lookupAttributes(url);
    }

As you can see, the URL used for comparison purposes is from the FilterInvocation.getRequestUrl() method, which looks like:

    public String getRequestUrl() {
        String pathInfo = getHttpRequest().getPathInfo();
        String queryString = getHttpRequest().getQueryString();

        return getHttpRequest().getServletPath()
        + ((pathInfo == null) ? "" : pathInfo)
        + ((queryString == null) ? "" : ("?" + queryString));
    }

Therefore your query string is part of the URL assessed by the FilterInvocationDefinitionSource.

As such you should be able to simply use regular expressions to look at the full URL and grant or deny accordingly.

[mavisakal]

Is it possible to check a url like below for a parameter name like method with a regular exp in filterInvocationInterceptor's objectDefinitionSource
i.e.
http://localhost:9080/MyApp/orderActions.do?param1=1&method=createOrder&param2=2

how can I write the url value for objectDefinitionSource with a regular expression which ignores other parameters and look for the parameter method value.

How can I write it?
<property name="objectDefinitionSource">
<value>
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
\A/order/orderactions.do?method=createOrder\Z=ROLE_ANONYMOUS,ROLE_USER </value>
</property>


Thanks...

[Ben Alex]

It's not the best way of doing it. You can't reliably parse for a parameter name/value in a query string and allow/deny accordingly. People can, for example, re-order the query parameters or encode them. I suppose you could try to write them in order, with a catch-all to detect re-ordering. eg:

foo.bar?gender=male&animal=donkey=role_male
foo.bar?gender=female&animal=cat=role_female
foo.bar*=deny

It's a lot safer to achieve security by moving the access decision to the services layer. Typically, your web controller uses RequestUtils.getStringParameter(HttpServletRequest ,String) and then passes the resulting String to a services layer method that has a custom AccessDecisionVoter. For example, AnimalServices.getByGender(String), which has a GenderDecisionVoter that applies different role requirements based on the String argument being passed to the services layer.

HTH clarify the recommended approach.