JAVA EE: Authentication Filter

Showing posts with label Authentication Filter. Show all posts

Thursday, 1 May 2014

Servlets : Multiple Filter Demo

Master Java Web Architecture!

Subscribe to Ram N Java for clean, hands-on tutorials on Java Servlets, FilterChains, and real-world backend design patterns!

🔔 Subscribe to Ram N Java

What is Filter Chaining in Java Servlets?

In Java web applications, a Servlet Filter intercepts incoming requests before they reach a servlet and inspects outgoing responses before they return to the client browser. When multiple filters are configured for the same URL pattern, the servlet container arranges them in a sequential pipeline called a FilterChain.

Each filter performs a specific task—such as logging request details, validating user credentials, or compressing response streams—and then invokes chain.doFilter(request, response) to hand off control to the next filter in line or to the target servlet.

Combining Authentication and Logging Filters

In this practical demonstration, two distinct filters work together seamlessly to protect and monitor a web resource:

LoggingFilter: Intercepts every incoming request first, capturing useful client metadata such as IP address, requested URI, and incoming timestamp before passing control down the chain.
AuthenticationFilter: Inspects user credentials or session tokens. If the credentials are valid, it passes control to the destination servlet; if invalid, it halts the chain immediately and redirects or displays an error message.

// Inside doFilter method of LoggingFilter:

    System.out.println("Incoming Request from IP: " + request.getRemoteAddr());

    chain.doFilter(request, response); // Passes request to AuthenticationFilter

    System.out.println("Response sent back to client.");


    // Inside doFilter method of AuthenticationFilter:

    if (isValidUser(request)) {

        chain.doFilter(request, response); // Passes request to target Servlet

    } else {

        response.getWriter().println("Authentication Failed: Access Denied!");

    }

How Execution Order is Determined

web.xml Configuration: The container executes filters in the exact order in which their <filter-mapping> elements are declared in web.xml.
Pre-Processing & Post-Processing: Code placed before chain.doFilter() runs before the servlet executes; code placed after chain.doFilter() executes during the response phase.
Separation of Concerns: Keeping cross-cutting concerns (security, audit logging) in separate filters keeps your servlets clean and maintainable.

Recommended Related Tutorials

Learn more about filters and servlet security with these handpicked tutorials from Ram N Java:

Click here to watch in Youtube : https://www.youtube.com/watch?v=BXL3FE3b6ic

Click the below Image to Enlarge

MultilpleFiltersDemo Project Dir Structure

LogFilter.java

import java.io.IOException;
import java.util.Date;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class LogFilter implements Filter
{

    public void init(FilterConfig config) throws ServletException
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" init method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }

    public void doFilter(ServletRequest req, ServletResponse res,
            FilterChain chain) throws IOException, ServletException
    {

        System.out.println(" doFilter method is called in "
                + this.getClass().getName() + "\n\n");

        HttpServletRequest request = (HttpServletRequest) req;

        // Get the IP address of client machine.
        String ipAddress = request.getRemoteAddr();

        // Log the IP address and current timestamp.
        System.out.println("IP " + ipAddress + ", Time "
                + new Date().toString() + "\n\n");

        chain.doFilter(req, res);

    }

    public void destroy()
    {
        // add code to release any resource
        System.out
                .println("------------------------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }
}

AuthenticationFilter.java

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class AuthenticationFilter implements Filter
{

    public void init(FilterConfig config) throws ServletException
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" init method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }

    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException
    {
        System.out.println(" doFilter method is called in "
                + this.getClass().getName() + "\n\n");

        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;

        String userName = req.getParameter("username");
        String passWord = req.getParameter("password");

        if (!(userName.equalsIgnoreCase("ram") && passWord.equals("ram")))
        {
            System.out
                    .println("######################################################");
            System.out.println("Unauthorized request");
            System.out
                    .println("######################################################\n\n");
            res.sendRedirect("index.html");
        }
        else
        {
            // pass the request along the filter chain
            chain.doFilter(request, response);
        }

    }

    public void destroy()
    {
        // add code to release any resource
        System.out
                .println("------------------------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }
}

HelloWorldServlet.java

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class HelloWorldServlet extends HttpServlet
{

    private static final long serialVersionUID = 1L;

    public void init() throws ServletException
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" Init method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }

    // Method to handle GET method request.
    public void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException
    {

        System.out.println(" doGet method is called in "
                + this.getClass().getName() + "\n\n");
        System.out
                .println("------------------------------------------------------");

        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.print("Hello World <br>");

    }

    public void destroy()
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }
}

web.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    metadata-complete="true" version="3.0">
    <display-name>MultilpleFiltersDemo</display-name>
    <description>
        This is a simple web application with a source code organization
        based on the recommendations of the Application Developer's Guide.
    </description>
    <servlet>
        <servlet-name>hello</servlet-name>
        <servlet-class>HelloWorldServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>hello</servlet-name>
        <url-pattern>/hello</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>LogFilter</filter-name>
        <filter-class>LogFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>LogFilter</filter-name>
        <url-pattern>/hello</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>AuthFilter</filter-name>
        <filter-class>AuthenticationFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>AuthFilter</filter-name>
        <url-pattern>/hello</url-pattern>
    </filter-mapping>

</web-app>

index.html

<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Multiple Filters Demo</title>
</head>
<body>
    <form action="hello" method="GET">
        
        UserName :  <input type="text" name="username" /><br /> 
        
        Password :&nbsp; &nbsp; <input type="password" name="password" /><br /> 
            
        <input type="submit" value="login" />
        
    </form>
</body>
</html>

Environment Used

JDK version :1.6.0_30
Tomcat version : 7.0.50

To Download MultilpleFiltersDemoApp Project Click the below link

https://sites.google.com/site/javaee4321/servlets/MultilpleFiltersDemoApp.zip?attredirects=0&d=1

See also:

Servlets Tutorial

All Design Patterns Links

Wednesday, 23 April 2014

Servlets : Authentication Filter

Master Java Web Security!

Subscribe to Ram N Java for beginner-friendly tutorials, practical web architecture demos, and clean backend coding techniques!

🔔 Subscribe to Ram N Java

What is an Authentication Filter?

In Java web development, security is critical. Rather than writing authentication and session validation logic inside every individual servlet, you can centralize your access control using a Servlet Authentication Filter.

An Authentication Filter intercepts incoming client requests before they ever reach protected servlets or web resources. It checks whether the user possesses a valid session, valid login credentials, or the required authorization token.

How the Authentication Filter Works

Inside the doFilter method, the filter checks the client's request state:

Authorized Request: If the user is authenticated (e.g., a valid session attribute exists), the filter calls chain.doFilter(request, response) to let the request continue to the target servlet.
Unauthorized Request: If the session is missing, invalid, or expired, the filter blocks access immediately and redirects the user to a login page or outputs an unauthorized error message.

HttpServletRequest req = (HttpServletRequest) request;

    HttpServletResponse res = (HttpServletResponse) response;

    HttpSession session = req.getSession(false);


    if (session != null && session.getAttribute("user") != null) {

        // User is logged in, proceed to requested resource

        chain.doFilter(request, response);

    } else {

        // User not logged in, redirect to login page

        res.sendRedirect("login.html");

    }

Key Benefits of Using Authentication Filters

Centralized Security: Protect multiple URLs and endpoints from a single place in your codebase.
Clean Codebase: Keep your business servlets free from redundant session validation checks.
Configurable Protection: Map the filter to broad URL patterns like /admin/* or /profile/* directly in web.xml.

Recommended Related Tutorials

Continue exploring servlet security and listener architectures with these tutorials from Ram N Java:

Click here to watch in Youtube : https://www.youtube.com/watch?v=X2ja-wJC02E

Click the below Image to Enlarge

Servlets : Authentication Filter

AuthenticationFilterDemo Project Dir Structure

Servlets : Authentication Filter

AuthenticationFilter.java

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

public class AuthenticationFilter implements Filter
{

 public void init(FilterConfig config) throws ServletException
 {
  System.out
          .println("------------------------------------------------------");
  System.out.println(" init method is called in "
          + this.getClass().getName());
  System.out
          .println("------------------------------------------------------");
 }

 public void doFilter(ServletRequest request, ServletResponse response,
         FilterChain chain) throws IOException, ServletException
 {

  System.out.println(" doFilter method is called in "
          + this.getClass().getName() + "\n\n");

  PrintWriter out = response.getWriter();

  String username = request.getParameter("username");
  String password = request.getParameter("password");
  if (username.equals("admin") && password.equals("admin"))
  {
   // sends request to next resource
   chain.doFilter(request, response);
  }
  else
  {
   out.print("username or password is not correct!");

  }
 }

 public void destroy()
 {
  // add code to release any resource
  System.out
          .println("------------------------------------------------------");
  System.out.println(" destroy method is called in "
          + this.getClass().getName());
  System.out
          .println("------------------------------------------------------");
 }
}

HelloServlet.java

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class HelloServlet extends HttpServlet
{
 private static final long serialVersionUID = 1L;

 public void init() throws ServletException
 {
  System.out
          .println("------------------------------------------------------");
  System.out.println(" Init method is called in "
          + this.getClass().getName());
  System.out
          .println("------------------------------------------------------");
 }

 public void doGet(HttpServletRequest request, HttpServletResponse response)
         throws ServletException, IOException
 {

  System.out.println(" doGet method is called in "
          + this.getClass().getName() + "\n\n");
  System.out
          .println("------------------------------------------------------");

  response.setContentType("text/html");
  PrintWriter out = response.getWriter();

  out.print("<br>welcome to helloservlet<br>");

 }

 public void destroy()
 {
  System.out
          .println("------------------------------------------------------");
  System.out.println(" destroy method is called in "
          + this.getClass().getName());
  System.out
          .println("------------------------------------------------------");
 }

}

web.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns="http://java.sun.com/xml/ns/javaee"
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
 metadata-complete="true" version="3.0">
 <display-name>AuthenticationFilterDemo</display-name>
 <description>
        This is a simple web application with a source code organization
        based on the recommendations of the Application Developer's Guide.
    </description>
 <servlet>
  <servlet-name>HelloServlet</servlet-name>
  <servlet-class>HelloServlet</servlet-class>
 </servlet>
 <servlet-mapping>
  <servlet-name>HelloServlet</servlet-name>
  <url-pattern>/hello</url-pattern>
 </servlet-mapping>
 <filter>
  <filter-name>AuthFilter</filter-name>
  <filter-class>AuthenticationFilter</filter-class>
 </filter>
 <filter-mapping>
  <filter-name>AuthFilter</filter-name>
  <url-pattern>/hello</url-pattern>
 </filter-mapping>
</web-app>

index.html

<html lang="en">
<head>
<meta charset="UTF-8">
<title>AuthenticationFilter Demo</title>
</head>
<body>
 <form action="hello" method="GET">
  
  UserName :  <input type="text" name="username" /><br /> 
  
  Password :&nbsp; &nbsp; <input type="password" name="password" /><br /> 
   
  <input type="submit" value="login" />
  
 </form>
</body>
</html>

Environment Used

JDK version :1.6.0_30
Tomcat version : 7.0.50

To Download AuthenticationFilterDemoApp Project Click the below link
https://sites.google.com/site/javaee4321/servlets/AuthenticationFilterDemoApp.zip?attredirects=0&d=1

See also:

Servlets Tutorial

All Design Patterns Links