jersey - 在 Resources 中的 ContainerRequestFilter 中创建的访问对象

Question

如何使 user 对象可用于资源中的进一步处理

   @Priority(Priorities.AUTHENTICATION)
   public static class ResourceAllowedRequestFilter implements ContainerRequestFilter {
      private AuthorizationValidation authorizationValidation;

      public ResourceAllowedRequestFilter() {
         try {
            authorizationValidation = new AuthorizationValidation();
         } catch (Exception e) {

         }
      }

      @Override
      public void filter(ContainerRequestContext requestContext) throws IOException {
         if (userHeader == null) {
           throw new BadRequestException(Response.status(Status.BAD_REQUEST).build());
         } else {
           User user = authorizationValidation.isAuthorizationValid(userHeader)
         }
      }
   }

   @GET
   @Path("/{page}/{limit}")
   public Response getBooks() {
     Access user object created in ContainerRequestFilter
   }

Answer 1

Afaig，只有一种方法可以做到这一点，称为注入(inject) - 但有多种使用注入(inject)的方法。

这里有两种方法:

1. 您可以实现/使用 javax.ws.rs.core.SecurityContext。因此，您的用户必须实现 java.security.Principal 并使用 @Context 将 SecurityContext 注入(inject)您的资源。下面的基本示例......

2. 您还可以构建并注册一个 Factory并将用户按请求注入(inject)到您的资源中。请访问 Jersey 文档，或搜索@stackoverflow。你会发现很多例子。

SecurityContext (1) 示例:

ContainerRequestFilter

@Override
public synchronized void filter(ContainerRequestContext request)
        throws IOException {

    final User user = authorizationValidation.isAuthorizationValid(userHeader)

    // impl 
    request.setSecurityContext( new MySecurityContext(user) );

    // or simple but not the best
    request.setSecurityContext( new SecurityContext() {
        @Override
        public boolean isUserInRole(String role) {
            return true; // check roles if you need ...
        }
        @Override
        public boolean isSecure() {
            return false; // check HTTPS
        }
        @Override
        public Principal getUserPrincipal() {
            return user; // return your user here - User must implement Principal
        }
        @Override
        public String getAuthenticationScheme() {
            return null; // ...
        }
    }
}

资源

@Context
protected SecurityContext securityContext;

@GET
@Path("/{page}/{limit}")
public Response getBooks() {
    User user = (User)securityContext.getUserPrincipal();
}

祝你有美好的一天......