From 91153d75981cd28e814db023581d54ffaa1311c7 Mon Sep 17 00:00:00 2001 From: Ravi Shanigarapu Date: Thu, 22 May 2025 15:24:54 +0530 Subject: [PATCH 1/2] JwtToken,User-Agent validation changes --- .../EmployeeMasterServiceImpl.java | 16 ++----- .../java/com/iemr/admin/utils/CookieUtil.java | 13 ++++-- .../utils/JwtUserIdValidationFilter.java | 34 ++++++++++----- .../iemr/admin/utils/RestTemplateUtil.java | 42 ++++++++++++++++++ .../iemr/admin/utils/UserAgentContext.java | 18 ++++++++ .../AuthorizationHeaderRequestWrapper.java | 43 +++++++++++++++++++ 6 files changed, 140 insertions(+), 26 deletions(-) create mode 100644 src/main/java/com/iemr/admin/utils/RestTemplateUtil.java create mode 100644 src/main/java/com/iemr/admin/utils/UserAgentContext.java create mode 100644 src/main/java/com/iemr/admin/utils/http/AuthorizationHeaderRequestWrapper.java diff --git a/src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java b/src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java index 8a0e9a3..23e9680 100644 --- a/src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java +++ b/src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java @@ -97,6 +97,7 @@ import com.iemr.admin.repository.rolemaster.M_UserservicerolemappingForRoleProviderAdminRepo; import com.iemr.admin.service.user.EncryptUserPassword; import com.iemr.admin.utils.CookieUtil; +import com.iemr.admin.utils.RestTemplateUtil; import com.iemr.admin.utils.config.ConfigProperties; import com.iemr.admin.utils.exception.IEMRException; import com.iemr.admin.utils.http.HttpUtils; @@ -462,17 +463,11 @@ private void updateSupervisorRoleInCTI(List resList1, private Set getCTICampaignRoles(String campaignName, String authToken) throws JsonMappingException, JsonProcessingException { RestTemplate restTemplate = new RestTemplate(); ObjectMapper objectMapper = new ObjectMapper(); - HttpServletRequest requestHeader = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()) - .getRequest(); - String jwtTokenFromCookie = cookieUtil.getJwtTokenFromCookie(requestHeader); Set resultSet = new HashSet(); - MultiValueMap headers = new LinkedMultiValueMap(); - headers.add("Content-Type", "application/json"); - headers.add("AUTHORIZATION", authToken); - headers.add("Jwttoken", jwtTokenFromCookie); + HttpEntity request = RestTemplateUtil.createRequestEntity(campaignName, authToken); String url = configProperties.getPropertyByName("common-url") + configProperties.getPropertyByName("create-feedback"); - HttpEntity request1 = new HttpEntity(campaignName, headers); - ResponseEntity responseStr = restTemplate.exchange(url, HttpMethod.POST, request1, String.class); + + ResponseEntity responseStr = restTemplate.exchange(url, HttpMethod.POST, request, String.class); OutputResponse response = objectMapper.readValue(responseStr.getBody(), OutputResponse.class); if (response.isSuccess()) { JSONObject obj = new JSONObject(response.getData()); @@ -481,9 +476,6 @@ private Set getCTICampaignRoles(String campaignName, String authToken) t resultSet.add(roles.getString(roleIndex)); } } -// JSONObject request = new JSONObject(); -// request.put("campaign", campaignName); - return resultSet; } diff --git a/src/main/java/com/iemr/admin/utils/CookieUtil.java b/src/main/java/com/iemr/admin/utils/CookieUtil.java index d90053e..a67bfc4 100644 --- a/src/main/java/com/iemr/admin/utils/CookieUtil.java +++ b/src/main/java/com/iemr/admin/utils/CookieUtil.java @@ -23,8 +23,15 @@ public Optional getCookieValue(HttpServletRequest request, String cookie return Optional.empty(); } - public String getJwtTokenFromCookie(HttpServletRequest request) { - return Arrays.stream(request.getCookies()).filter(cookie -> "Jwttoken".equals(cookie.getName())) - .map(Cookie::getValue).findFirst().orElse(null); + public static String getJwtTokenFromCookie(HttpServletRequest request) { + Cookie[] cookies = request.getCookies(); + if (cookies == null) { + return null; // No cookies present, return null safely + } + return Arrays.stream(cookies) + .filter(cookie -> "Jwttoken".equals(cookie.getName())) + .map(Cookie::getValue) + .findFirst() + .orElse(null); } } diff --git a/src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java b/src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java index 7cae90e..9cc9c39 100644 --- a/src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java +++ b/src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java @@ -6,6 +6,8 @@ import org.slf4j.LoggerFactory; import org.springframework.stereotype.Component; +import com.iemr.admin.utils.http.AuthorizationHeaderRequestWrapper; + import jakarta.servlet.Filter; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; @@ -72,25 +74,35 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo if (jwtFromCookie != null) { logger.info("Validating JWT token from cookie"); if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromCookie)) { - filterChain.doFilter(servletRequest, servletResponse); + AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper( + request, ""); + filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse); return; } - } - - if (jwtFromHeader != null) { + } else if (jwtFromHeader != null) { logger.info("Validating JWT token from header"); if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromHeader)) { - filterChain.doFilter(servletRequest, servletResponse); + AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper( + request, ""); + filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse); + return; + } + } else { + String userAgent = request.getHeader("User-Agent"); + logger.info("User-Agent: " + userAgent); + if (userAgent != null && isMobileClient(userAgent) && authHeader != null) { + try { + UserAgentContext.setUserAgent(userAgent); + filterChain.doFilter(servletRequest, servletResponse); + } finally { + UserAgentContext.clear(); + } return; } } - String userAgent = request.getHeader("User-Agent"); - logger.info("User-Agent: " + userAgent); - if (userAgent != null && isMobileClient(userAgent) && authHeader != null) { - filterChain.doFilter(servletRequest, servletResponse); - return; - } + logger.warn("No valid authentication token found"); + response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token"); logger.warn("No valid authentication token found"); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token"); diff --git a/src/main/java/com/iemr/admin/utils/RestTemplateUtil.java b/src/main/java/com/iemr/admin/utils/RestTemplateUtil.java new file mode 100644 index 0000000..03b7a8f --- /dev/null +++ b/src/main/java/com/iemr/admin/utils/RestTemplateUtil.java @@ -0,0 +1,42 @@ +package com.iemr.admin.utils; + +import org.springframework.http.HttpEntity; +import org.springframework.http.HttpHeaders; +import org.springframework.http.MediaType; +import org.springframework.util.LinkedMultiValueMap; +import org.springframework.util.MultiValueMap; +import org.springframework.web.context.request.RequestContextHolder; +import org.springframework.web.context.request.ServletRequestAttributes; + +import jakarta.servlet.http.HttpServletRequest; + +public class RestTemplateUtil { + public static HttpEntity createRequestEntity(Object body, String authorization) { + + ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()); + if (servletRequestAttributes == null) { + MultiValueMap headers = new LinkedMultiValueMap<>(); + headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8"); + headers.add(HttpHeaders.AUTHORIZATION, authorization); + return new HttpEntity<>(body, headers); + } + HttpServletRequest requestHeader = servletRequestAttributes.getRequest(); + String jwtTokenFromCookie = null; + try { + jwtTokenFromCookie = CookieUtil.getJwtTokenFromCookie(requestHeader); + + } catch (Exception e) { + e.printStackTrace(); + } + + MultiValueMap headers = new LinkedMultiValueMap<>(); + headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8"); + headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent()); + headers.add(HttpHeaders.AUTHORIZATION, authorization); + headers.add("JwtToken",requestHeader.getHeader("JwtToken")); + headers.add(HttpHeaders.COOKIE, "Jwttoken=" + jwtTokenFromCookie); + + return new HttpEntity<>(body, headers); + } + +} diff --git a/src/main/java/com/iemr/admin/utils/UserAgentContext.java b/src/main/java/com/iemr/admin/utils/UserAgentContext.java new file mode 100644 index 0000000..d869cd8 --- /dev/null +++ b/src/main/java/com/iemr/admin/utils/UserAgentContext.java @@ -0,0 +1,18 @@ +package com.iemr.admin.utils; + +public class UserAgentContext { + private static final ThreadLocal userAgentHolder = new ThreadLocal<>(); + + public static void setUserAgent(String userAgent) { + userAgentHolder.set(userAgent); + } + + public static String getUserAgent() { + return userAgentHolder.get(); + } + + public static void clear() { + userAgentHolder.remove(); + } + +} \ No newline at end of file diff --git a/src/main/java/com/iemr/admin/utils/http/AuthorizationHeaderRequestWrapper.java b/src/main/java/com/iemr/admin/utils/http/AuthorizationHeaderRequestWrapper.java new file mode 100644 index 0000000..a1b6e38 --- /dev/null +++ b/src/main/java/com/iemr/admin/utils/http/AuthorizationHeaderRequestWrapper.java @@ -0,0 +1,43 @@ +package com.iemr.admin.utils.http; + +import java.util.Collections; +import java.util.Enumeration; +import java.util.List; + +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletRequestWrapper; + +public class AuthorizationHeaderRequestWrapper extends HttpServletRequestWrapper{ + private final String Authorization; + + public AuthorizationHeaderRequestWrapper(HttpServletRequest request, String authHeaderValue) { + super(request); + this.Authorization = authHeaderValue; + } + + @Override + public String getHeader(String name) { + if ("Authorization".equalsIgnoreCase(name)) { + return Authorization; + } + return super.getHeader(name); + } + + @Override + public Enumeration getHeaders(String name) { + if ("Authorization".equalsIgnoreCase(name)) { + return Collections.enumeration(Collections.singletonList(Authorization)); + } + return super.getHeaders(name); + } + + @Override + public Enumeration getHeaderNames() { + List names = Collections.list(super.getHeaderNames()); + if (!names.contains("Authorization")) { + names.add("Authorization"); + } + return Collections.enumeration(names); + } +} + From 30f7b620e74a06187d9ddf97a2cc4215722ce66b Mon Sep 17 00:00:00 2001 From: Ravi Shanigarapu Date: Thu, 22 May 2025 19:38:35 +0530 Subject: [PATCH 2/2] null check --- .../com/iemr/admin/utils/RestTemplateUtil.java | 16 ++++++++++++---- .../admin/utils/http/HTTPRequestInterceptor.java | 4 ++++ 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/src/main/java/com/iemr/admin/utils/RestTemplateUtil.java b/src/main/java/com/iemr/admin/utils/RestTemplateUtil.java index 03b7a8f..d61e269 100644 --- a/src/main/java/com/iemr/admin/utils/RestTemplateUtil.java +++ b/src/main/java/com/iemr/admin/utils/RestTemplateUtil.java @@ -1,5 +1,7 @@ package com.iemr.admin.utils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.http.HttpEntity; import org.springframework.http.HttpHeaders; import org.springframework.http.MediaType; @@ -11,6 +13,8 @@ import jakarta.servlet.http.HttpServletRequest; public class RestTemplateUtil { + private final static Logger logger = LoggerFactory.getLogger(RestTemplateUtil.class); + public static HttpEntity createRequestEntity(Object body, String authorization) { ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()); @@ -26,17 +30,21 @@ public static HttpEntity createRequestEntity(Object body, String authori jwtTokenFromCookie = CookieUtil.getJwtTokenFromCookie(requestHeader); } catch (Exception e) { - e.printStackTrace(); + logger.error("Error while getting jwtToken from Cookie" + e.getMessage() ); } MultiValueMap headers = new LinkedMultiValueMap<>(); headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8"); - headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent()); + if(null != UserAgentContext.getUserAgent()) { + headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent()); + } headers.add(HttpHeaders.AUTHORIZATION, authorization); headers.add("JwtToken",requestHeader.getHeader("JwtToken")); - headers.add(HttpHeaders.COOKIE, "Jwttoken=" + jwtTokenFromCookie); + if(null != jwtTokenFromCookie) { + headers.add(HttpHeaders.COOKIE, "Jwttoken=" + jwtTokenFromCookie); + } return new HttpEntity<>(body, headers); } -} +} \ No newline at end of file diff --git a/src/main/java/com/iemr/admin/utils/http/HTTPRequestInterceptor.java b/src/main/java/com/iemr/admin/utils/http/HTTPRequestInterceptor.java index ea3ed40..665f156 100644 --- a/src/main/java/com/iemr/admin/utils/http/HTTPRequestInterceptor.java +++ b/src/main/java/com/iemr/admin/utils/http/HTTPRequestInterceptor.java @@ -60,6 +60,10 @@ public boolean preHandle(HttpServletRequest request, HttpServletResponse respons authorization=preAuth.replace("Bearer ", ""); else authorization = preAuth; + if (authorization == null || authorization.isEmpty()) { + logger.info("Authorization header is null or empty. Skipping HTTPRequestInterceptor."); + return true; // Allow the request to proceed without validation + } if (!request.getMethod().equalsIgnoreCase("OPTIONS")) { try { String[] requestURIParts = request.getRequestURI().split("/");