Question

I am trying to implement a filter that uses MockHttpServletRequest to add a header to the request object. I want to use that header for preauthentication. This is the filter class..

public class MockAuthFilter implements Filter{

   private FilterConfig filterConfig = null;
   private static String loggedInUserName = "myId";
   private static String httpRequestHeaderName = "SM_ID";
   private Logger logger = Logger.getLogger(MockAuthFilter.class);

   @Override
   public void destroy() {
     this.filterConfig = null;
   }

   @Override
   public void doFilter(ServletRequest request, ServletResponse response,
        FilterChain chain) throws IOException, ServletException {

      if(this.filterConfig.getServletContext() == null){}

      HttpServletRequest httpRequest = (HttpServletRequest) request;        
      MockHttpServletRequest mRequest = new MockHttpServletRequest(this.filterConfig.getServletContext());
      if(mRequest.getHeader(httpRequestHeaderName)==null ||
            !mRequest.getHeader(httpRequestHeaderName).equalsIgnoreCase(loggedInUserName))
        mRequest.addHeader(httpRequestHeaderName, loggedInUserName);

      mRequest.setMethod("GET");
      mRequest.setRequestURI(httpRequest.getRequestURL().toString());
      logger.debug("**********************exiting doFilter() method*****************");
      chain.doFilter(mRequest, response);
     }

@Override
public void init(FilterConfig config) throws ServletException {
    this.filterConfig = config;
}

}

but there is not url populated when the request reaches the next filter in the filter chain of Spring Security. I see following lines in the log file..

  [2011-10-13 16:52:35,114] [DEBUG] [http-8080-1] [com.app.filter.MockAuthFilter:doFilter:55] - **********************exiting doFilter() method*****************
  [2011-10-13 16:52:35,114] [DEBUG] [http-8080-1] [com.app.filter.MockAuthFilter:doFilter:55] - **********************exiting doFilter() method*****************
  [2011-10-13 16:52:35,114] [DEBUG] [http-8080-1] [org.springframework.security.web.util.AntPathRequestMatcher:matches:103] - Checking match of request : ''; against '/static/**'
   [2011-10-13 16:52:35,114] [DEBUG] [http-8080-1][org.springframework.security.web.util.AntPathRequestMatcher:matches:103] - Checking match of request : ''; against '/static/**'

As you can see there was no url in the request object passed onto AntPathrequestMatcher’s matches method..
I have checked mockrequest object right before chain.doFilter() method and it contains the url value in its requestURI field. if URI and URL aren’t the same thing here, what changes should I make here so that url is maintained in the request object..

Answer 1

1. Don’t use MockHttpServletRequest like that. It’s for testing, not for production code. The appropriate way to wrap a request and/or response in a filter to modify its behavior later on is with HttpServletRequestWrapper and HttpServletResponseWrapper.
2. Why are you even trying to wrap or remove the original request if all you want is to add a header? Just use addHeader() on the incoming request.
3. Trying to change the request method and request URI in the filter as you’re doing may have unexpected consequences and will almost certainly not do what you probably expect it to do. By the time the request hits your filter, the filter chain has already been built based on the original state of the request. Changing it now won’t affect where it ends up going.