Skip to content

Commit 02e6a68

Browse files
SamuelDouaySamuelDouay
committed
simplify auth, csrf, cors filter
1 parent b138380 commit 02e6a68

File tree

8 files changed

+232
-688
lines changed

8 files changed

+232
-688
lines changed

‎src/main/java/fr/github/vera/filters/AuthorizationFilter.java‎

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@
1212
import org.apache.logging.log4j.LogManager;
1313
import org.apache.logging.log4j.Logger;
1414

15-
import java.lang.reflect.Method;
16-
1715
@Secured
1816
@Provider
1917
@Priority(Priorities.AUTHORIZATION)
@@ -51,23 +49,11 @@ public void filter(ContainerRequestContext requestContext) {
5149
}
5250

5351
private Secured getSecuredAnnotation() {
54-
// Vérifier d'abord sur la méthode
55-
Method method = resourceInfo.getResourceMethod();
56-
if (method != null) {
57-
Secured methodAnnotation = method.getAnnotation(Secured.class);
58-
if (methodAnnotation != null) {
59-
return methodAnnotation;
60-
}
61-
}
52+
Secured methodAnnotation = resourceInfo.getResourceMethod()
53+
.getAnnotation(Secured.class);
6254

63-
// Vérifier sur la classe
64-
Class<?> resourceClass = resourceInfo.getResourceClass();
65-
if (resourceClass != null) {
66-
Secured classAnnotation = resourceClass.getAnnotation(Secured.class);
67-
if (classAnnotation != null) {
68-
return classAnnotation;
69-
}
70-
}
71-
return null;
55+
return methodAnnotation != null ? methodAnnotation
56+
: resourceInfo.getResourceClass()
57+
.getAnnotation(Secured.class);
7258
}
7359
}

‎src/main/java/fr/github/vera/filters/CookieAuthFilter.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,12 @@ public class CookieAuthFilter implements ContainerRequestFilter {
2323

2424
@Override
2525
public void filter(ContainerRequestContext requestContext) throws IOException {
26-
// Si le header Authorization existe déjà, ne rien faire
26+
2727
if (requestContext.getHeaders().containsKey(AUTH_HEADER)) {
2828
logger.debug("Header Authorization déjà présent - skip CookieAuthFilter");
2929
return;
3030
}
3131

32-
// Vérifier si c'est un client web
3332
String clientType = requestContext.getHeaderString(CLIENT_TYPE_HEADER);
3433
boolean isWebClient = WEB_CLIENT.equalsIgnoreCase(clientType);
3534

@@ -38,11 +37,9 @@ public void filter(ContainerRequestContext requestContext) throws IOException {
3837
return;
3938
}
4039

41-
// Extraire le token du cookie (seulement pour les clients web)
4240
Cookie authCookie = requestContext.getCookies().get(AUTH_COOKIE_NAME);
4341

4442
if (authCookie != null && authCookie.getValue() != null && !authCookie.getValue().isEmpty()) {
45-
// Ajouter le token dans le header Authorization
4643
requestContext.getHeaders().add(AUTH_HEADER, "Bearer " + authCookie.getValue());
4744
logger.debug("Token extrait du cookie et ajouté au header");
4845
} else {

‎src/main/java/fr/github/vera/filters/CorsFilter.java‎

Lines changed: 65 additions & 246 deletions
Large diffs are not rendered by default.

‎src/main/java/fr/github/vera/filters/CsrfFilter.java‎

Lines changed: 18 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,15 @@
22

33
import jakarta.annotation.Priority;
44
import jakarta.ws.rs.Priorities;
5-
import jakarta.ws.rs.container.ContainerRequestContext;
6-
import jakarta.ws.rs.container.ContainerRequestFilter;
7-
import jakarta.ws.rs.container.ContainerResponseContext;
8-
import jakarta.ws.rs.container.ContainerResponseFilter;
5+
import jakarta.ws.rs.container.*;
6+
import jakarta.ws.rs.core.Context;
97
import jakarta.ws.rs.core.Response;
108
import jakarta.ws.rs.ext.Provider;
119
import org.apache.logging.log4j.LogManager;
1210
import org.apache.logging.log4j.Logger;
1311

1412
import java.io.IOException;
13+
import java.lang.reflect.Method;
1514
import java.security.SecureRandom;
1615
import java.util.Base64;
1716
import java.util.Map;
@@ -25,33 +24,23 @@ public class CsrfFilter implements ContainerRequestFilter, ContainerResponseFilt
2524
private static final String CSRF_TOKEN_HEADER = "X-CSRF-Token";
2625
private static final String CLIENT_TYPE_HEADER = "X-Client-Type";
2726
private static final String WEB_CLIENT = "web";
28-
29-
// Stockage en mémoire (session utilisateur -> token)
3027
private static final Map<String, String> tokenStore = new ConcurrentHashMap<>();
3128

29+
30+
@Context
31+
private ResourceInfo resourceInfo;
32+
3233
@Override
3334
public void filter(ContainerRequestContext requestContext) throws IOException {
3435
String method = requestContext.getMethod();
3536
String path = requestContext.getUriInfo().getPath();
3637

37-
// Méthodes sûres : pas besoin de vérifier CSRF
38-
if ("GET".equals(method) || "HEAD".equals(method) || "OPTIONS".equals(method)) {
39-
return;
40-
}
41-
42-
// Endpoints publics - pas de CSRF
43-
if (path.startsWith("auth/login") ||
44-
path.startsWith("auth/register") ||
45-
path.startsWith("auth/refresh") ||
46-
path.startsWith("auth/forgot-password") ||
47-
path.startsWith("auth/reset-password") ||
48-
path.equals("health")) {
38+
if ("GET".equals(method) || "HEAD".equals(method) || "OPTIONS".equals(method) || isPublicEndpoint()) {
4939
return;
5040
}
5141

52-
// 🔥 Vérifier si c'est un client web
5342
if (!isWebClient(requestContext)) {
54-
logger.debug("Client API (Postman) - skip CSRF pour {} {}", method, path);
43+
logger.debug("Client API - non web - skip CSRF pour {} {}", method, path);
5544
return;
5645
}
5746

@@ -62,7 +51,6 @@ public void filter(ContainerRequestContext requestContext) throws IOException {
6251
return;
6352
}
6453

65-
// Vérifier le token CSRF
6654
String csrfToken = requestContext.getHeaderString(CSRF_TOKEN_HEADER);
6755
String storedToken = tokenStore.get(sessionId);
6856

@@ -79,8 +67,6 @@ public void filter(ContainerRequestContext requestContext) throws IOException {
7967
@Override
8068
public void filter(ContainerRequestContext requestContext,
8169
ContainerResponseContext responseContext) throws IOException {
82-
83-
// 🔥 Générer token CSRF SEULEMENT pour les clients web
8470
if ("GET".equals(requestContext.getMethod()) && isWebClient(requestContext)) {
8571
String sessionId = getSessionId(requestContext);
8672
if (sessionId != null) {
@@ -99,7 +85,6 @@ private boolean isWebClient(ContainerRequestContext requestContext) {
9985
}
10086

10187
private String getSessionId(ContainerRequestContext request) {
102-
// Utiliser le token JWT comme session ID
10388
String authHeader = request.getHeaderString("Authorization");
10489
if (authHeader != null && authHeader.startsWith("Bearer ")) {
10590
String jwtToken = authHeader.substring(7);
@@ -114,4 +99,13 @@ private String generateToken() {
11499
random.nextBytes(bytes);
115100
return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
116101
}
102+
103+
private boolean isPublicEndpoint() {
104+
Method method = resourceInfo.getResourceMethod();
105+
Class<?> resourceClass = resourceInfo.getResourceClass();
106+
if (method != null && method.isAnnotationPresent(Public.class)) {
107+
return true;
108+
}
109+
return resourceClass != null && resourceClass.isAnnotationPresent(Public.class);
110+
}
117111
}

‎src/main/java/fr/github/vera/filters/JwtAuthFilter.java‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ public void filter(ContainerRequestContext requestContext) {
3131
return;
3232
}
3333

34-
// Extraire le token JWT
3534
String authHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
3635
if (authHeader == null || !authHeader.startsWith("Bearer ")) {
3736
abortWithUnauthorized(requestContext, "Token JWT manquant");
@@ -53,10 +52,9 @@ public void filter(ContainerRequestContext requestContext) {
5352
Boolean isAdmin = claims.get("isAdmin", Boolean.class);
5453

5554
if (isAdmin == null) {
56-
isAdmin = false; // Valeur par défaut si non présent
55+
isAdmin = false;
5756
}
5857

59-
// Définir le contexte de sécurité
6058
requestContext.setSecurityContext(createSecurityContext(email, isAdmin));
6159

6260
} catch (Exception e) {
@@ -73,13 +71,9 @@ private boolean isTokenBlacklisted(String token) {
7371
private boolean isPublicEndpoint() {
7472
Method method = resourceInfo.getResourceMethod();
7573
Class<?> resourceClass = resourceInfo.getResourceClass();
76-
77-
// Vérifier l'annotation sur la méthode
7874
if (method != null && method.isAnnotationPresent(Public.class)) {
7975
return true;
8076
}
81-
82-
// Vérifier l'annotation sur la classe
8377
return resourceClass != null && resourceClass.isAnnotationPresent(Public.class);
8478
}
8579

@@ -100,7 +94,6 @@ public boolean isUserInRole(String role) {
10094
if ("admin".equals(role)) {
10195
return isAdmin;
10296
}
103-
// Pour "user", tous les utilisateurs authentifiés sont considérés comme users
10497
return "user".equals(role);
10598
}
10699

0 commit comments

Comments
 (0)