Showing posts with label Servlet Filters. Show all posts

Thursday, 4 July 2019

How to add a Servlet filter in Spring Boot? | Spring Boot - Servlet Filter

🚀 Level Up Your Java Skills! 🚀

Don't miss out on weekly tutorials that make complex Spring Boot concepts easy.

Introduction to Servlet Filters in Spring Boot

Imagine a security guard standing at the entrance of a building. They check every person entering or leaving to ensure everything is safe. In the world of web applications, Servlet Filters do exactly that!

What is a Servlet Filter?

A Filter is an object that performs filtering tasks on either the request to a resource (like a servlet or static content), or on the response from a resource, or both.

In Spring Boot, filters are used to intercept HTTP requests before they reach your controllers. This is perfect for cross-cutting concerns like:

Logging request details (IP address, time, etc.)
Authentication and Authorization
Data Compression
Encryption/Decryption

How It Works: The "Chain" Concept

Filters work in a "chain." When a request comes in, it passes through Filter A, then Filter B, and finally reaches your application. When the response is sent back, it travels back through the chain in reverse order.

Basic Implementation

Creating a filter in Spring Boot is as simple as implementing the Filter interface and marking it as a @Component.

        @Component

        public class MyFilter implements Filter {

            @Override

            public void doFilter(ServletRequest request, ... ) {

                // Logic before the request hits the controller

                chain.doFilter(request, response);

                // Logic after the controller completes

            }

        }

Check Out These Related Tutorials

To dive deeper into the Spring Boot ecosystem, watch these videos next:

➜ Spring Boot Actuator: Your Secret Weapon for Production-Ready Apps ➜ Unlock JWT Token Authentication in Spring Boot for Seamless User Sign-In ➜ Master Exception Handling in Spring Boot with ControllerAdvice

Thursday, 1 May 2014

Servlets : Multiple Filter Demo

Master Java Web Architecture!

Subscribe to Ram N Java for clean, hands-on tutorials on Java Servlets, FilterChains, and real-world backend design patterns!

🔔 Subscribe to Ram N Java

What is Filter Chaining in Java Servlets?

In Java web applications, a Servlet Filter intercepts incoming requests before they reach a servlet and inspects outgoing responses before they return to the client browser. When multiple filters are configured for the same URL pattern, the servlet container arranges them in a sequential pipeline called a FilterChain.

Each filter performs a specific task—such as logging request details, validating user credentials, or compressing response streams—and then invokes chain.doFilter(request, response) to hand off control to the next filter in line or to the target servlet.

Combining Authentication and Logging Filters

In this practical demonstration, two distinct filters work together seamlessly to protect and monitor a web resource:

LoggingFilter: Intercepts every incoming request first, capturing useful client metadata such as IP address, requested URI, and incoming timestamp before passing control down the chain.
AuthenticationFilter: Inspects user credentials or session tokens. If the credentials are valid, it passes control to the destination servlet; if invalid, it halts the chain immediately and redirects or displays an error message.

// Inside doFilter method of LoggingFilter:

    System.out.println("Incoming Request from IP: " + request.getRemoteAddr());

    chain.doFilter(request, response); // Passes request to AuthenticationFilter

    System.out.println("Response sent back to client.");


    // Inside doFilter method of AuthenticationFilter:

    if (isValidUser(request)) {

        chain.doFilter(request, response); // Passes request to target Servlet

    } else {

        response.getWriter().println("Authentication Failed: Access Denied!");

    }

How Execution Order is Determined

web.xml Configuration: The container executes filters in the exact order in which their <filter-mapping> elements are declared in web.xml.
Pre-Processing & Post-Processing: Code placed before chain.doFilter() runs before the servlet executes; code placed after chain.doFilter() executes during the response phase.
Separation of Concerns: Keeping cross-cutting concerns (security, audit logging) in separate filters keeps your servlets clean and maintainable.

Recommended Related Tutorials

Learn more about filters and servlet security with these handpicked tutorials from Ram N Java:

Click here to watch in Youtube : https://www.youtube.com/watch?v=BXL3FE3b6ic

Click the below Image to Enlarge

MultilpleFiltersDemo Project Dir Structure

LogFilter.java

import java.io.IOException;
import java.util.Date;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class LogFilter implements Filter
{

    public void init(FilterConfig config) throws ServletException
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" init method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }

    public void doFilter(ServletRequest req, ServletResponse res,
            FilterChain chain) throws IOException, ServletException
    {

        System.out.println(" doFilter method is called in "
                + this.getClass().getName() + "\n\n");

        HttpServletRequest request = (HttpServletRequest) req;

        // Get the IP address of client machine.
        String ipAddress = request.getRemoteAddr();

        // Log the IP address and current timestamp.
        System.out.println("IP " + ipAddress + ", Time "
                + new Date().toString() + "\n\n");

        chain.doFilter(req, res);

    }

    public void destroy()
    {
        // add code to release any resource
        System.out
                .println("------------------------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }
}

AuthenticationFilter.java

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class AuthenticationFilter implements Filter
{

    public void init(FilterConfig config) throws ServletException
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" init method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }

    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException
    {
        System.out.println(" doFilter method is called in "
                + this.getClass().getName() + "\n\n");

        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;

        String userName = req.getParameter("username");
        String passWord = req.getParameter("password");

        if (!(userName.equalsIgnoreCase("ram") && passWord.equals("ram")))
        {
            System.out
                    .println("######################################################");
            System.out.println("Unauthorized request");
            System.out
                    .println("######################################################\n\n");
            res.sendRedirect("index.html");
        }
        else
        {
            // pass the request along the filter chain
            chain.doFilter(request, response);
        }

    }

    public void destroy()
    {
        // add code to release any resource
        System.out
                .println("------------------------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }
}

HelloWorldServlet.java

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class HelloWorldServlet extends HttpServlet
{

    private static final long serialVersionUID = 1L;

    public void init() throws ServletException
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" Init method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }

    // Method to handle GET method request.
    public void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException
    {

        System.out.println(" doGet method is called in "
                + this.getClass().getName() + "\n\n");
        System.out
                .println("------------------------------------------------------");

        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.print("Hello World <br>");

    }

    public void destroy()
    {
        System.out
                .println("------------------------------------------------------");
        System.out.println(" destroy method is called in "
                + this.getClass().getName());
        System.out
                .println("------------------------------------------------------");
    }
}

web.xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    metadata-complete="true" version="3.0">
    <display-name>MultilpleFiltersDemo</display-name>
    <description>
        This is a simple web application with a source code organization
        based on the recommendations of the Application Developer's Guide.
    </description>
    <servlet>
        <servlet-name>hello</servlet-name>
        <servlet-class>HelloWorldServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>hello</servlet-name>
        <url-pattern>/hello</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>LogFilter</filter-name>
        <filter-class>LogFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>LogFilter</filter-name>
        <url-pattern>/hello</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>AuthFilter</filter-name>
        <filter-class>AuthenticationFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>AuthFilter</filter-name>
        <url-pattern>/hello</url-pattern>
    </filter-mapping>

</web-app>

index.html

<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Multiple Filters Demo</title>
</head>
<body>
    <form action="hello" method="GET">
        
        UserName :  <input type="text" name="username" /><br /> 
        
        Password :&nbsp; &nbsp; <input type="password" name="password" /><br /> 
            
        <input type="submit" value="login" />
        
    </form>
</body>
</html>

Environment Used

JDK version :1.6.0_30
Tomcat version : 7.0.50

To Download MultilpleFiltersDemoApp Project Click the below link

https://sites.google.com/site/javaee4321/servlets/MultilpleFiltersDemoApp.zip?attredirects=0&d=1

See also:

Servlets Tutorial

All Design Patterns Links

Servlets : Single Filter Demo

Master Core Java & Servlets!

Subscribe to Ram N Java for beginner-friendly coding walkthroughs, web architecture guides, and practical backend demonstrations!

🔔 Subscribe to Ram N Java

What is a Servlet Filter?

In Java web applications, a Filter is a pluggable Java component that intercepts incoming client requests before they hit a servlet, and inspects outgoing responses before they are returned to the browser.

Filters are ideal for cross-cutting tasks such as logging request metadata, verifying user credentials, modifying headers, or compressing data—without modifying the business logic inside the target servlet itself.

How a Single Filter Works in Practice

To implement a servlet filter, your class must implement the javax.servlet.Filter interface and override its core methods:

init(FilterConfig config): Called once by the web container when initializing the filter.
doFilter(ServletRequest request, ServletResponse response, FilterChain chain): Executes every time a matching request arrives.
destroy(): Called once when the filter is taken out of service.

// Step 1: Pre-processing before servlet invocation

    System.out.println("Filter: Pre-processing client request...");


    // Step 2: Pass control to the destination servlet or next filter

    chain.doFilter(request, response);


    // Step 3: Post-processing after servlet generates response

    System.out.println("Filter: Post-processing server response...");

Key Takeaways from the Demo

web.xml Configuration: The filter is mapped to specific servlet names or URL patterns using <filter> and <filter-mapping> tags.
chain.doFilter() is Crucial: Failing to invoke chain.doFilter() blocks the request and prevents the servlet from executing.
Two-Way Interception: Code written before chain.doFilter() executes during the request phase, while code written after runs during the response phase.

Thursday, 24 April 2014

Servlets : Filter Config Demo

Level Up Your Java Web Skills!

Subscribe to Ram N Java for hands-on, practical Java Servlets walkthroughs, backend architecture guides, and clear code demonstrations!

🔔 Subscribe to Ram N Java

What is FilterConfig in Java Servlets?

In Java web applications, the FilterConfig interface is part of the javax.servlet package. It is an object used by the servlet container to pass configuration information and initialization parameters to a filter during startup.

Just like ServletConfig provides initialization parameters to a servlet, FilterConfig supplies filter-specific parameters configured inside deployment descriptor files (such as web.xml) or annotations, allowing your filter to remain dynamic without hardcoding values in Java code.

How FilterConfig Works During Initialization

When the web application starts up, the web container creates an instance of your filter and invokes its init(FilterConfig filterConfig) method exactly once.

getInitParameter(String name): Retrieves the value of a specific initialization parameter configured for this filter.
getInitParameterNames(): Returns an Enumeration containing the names of all initialization parameters defined for the filter.
getFilterName(): Returns the name of the filter as specified in the deployment configuration.
getServletContext(): Returns a reference to the ServletContext, enabling access to application-wide resources.

public void init(FilterConfig filterConfig) throws ServletException {

        // Reading init parameter configured in web.xml

        String constructionMode = filterConfig.getInitParameter("construction");

        System.out.println("Under Construction Mode: " + constructionMode);

    }

Why Use FilterConfig?

Configuration Flexibility: Change operational parameters (such as site maintenance flags, encoding schemes, or logging levels) in web.xml without modifying or recompiling Java code.
Scoped Exclusively to the Filter: Initialization parameters defined in <filter> are private to that filter and cannot be accessed by other servlets or filters.
Access to ServletContext: Allows your filter to interact with application-level data and event logging easily.