Question

I’m doing a web with JAASRealm authentication (in tomcat 7).
This is a filter for the servlets:

private String loginPage = "welcome.jsp";

@Override
public void doFilter(ServletRequest request, ServletResponse response,
        FilterChain filterChain) throws IOException, ServletException {

    if ((request instanceof HttpServletRequest) && (response instanceof HttpServletResponse)) {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
        if (httpServletRequest.getUserPrincipal() == null) {
            // User is not logged in, redirect to login page.
            httpServletRequest.setAttribute("from", httpServletRequest.getRequestURI());
            httpServletResponse.sendRedirect(loginPage);
        }
        else {
            filterChain.doFilter(request, response);
        }
    }
}

And I have declared it in web.xml

<filter>
    <filter-name>login-filter</filter-name>
    <filter-class>LoginFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>login-filter</filter-name>
    <url-pattern>/sampleServlet</url-pattern>
</filter-mapping>

My problem is when I’m not authenticated and I call the servlet via AJAX, this line of filter doesn’t work

httpServletResponse.sendRedirect(loginPage);

So, I haven’t receive any data and I’m not redirected to the loggin page. What can I do in this case?

Answer 1

Here is how I send re-directs when Filtering AJAX requests…

AJAX Code (jQuery)

$.ajax({
    type: 'post',
    url: '/signMeInServlet',
    data: {
        'name': name,
        'pass': passW,
        },
    dataType: 'json',
    success: processSignInReturnMethod,
    error: function (xhr, ajaxOptions, thrownError){
        if (thrownError.redirect.length) {
            window.location.replace(thrownError.redirect);
        } else {
            alert('There was an error processing your request, please try again');
        }
    }
});

Relevant Filter Code

// Rest of your Filter processing and logic here, once you know you want
// to redirect, use the below code, which works for both AJAX and regualar
// requests

HttpServletRequest hreq = (HttpServletRequest) request;
String redirectUrl = "/redirected.jsp";

if (hreq.getHeader("x-requested-with") != null && 
        hreq.getHeader("x-requested-with").equalsIgnoreCase("XMLHttpRequest")) {

    // Set up your response here
    HttpServletResponse hres = (HttpServletResponse) response;
    hres.setContentType("text/json; charset=UTF-8");

    PrintWriter out = hres.getWriter();

    String json = "[{\"redirect\":\"" + redirectUrl + "\"}]";

    out.write(json);
    out.flush();
    out.close();

} else {

    ((HttpServletResponse)response).sendRedirect(redirectUrl);
}