Skip to content

JwtToken,User-Agent validation changes #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 22, 2025
Merged

JwtToken,User-Agent validation changes #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91153d7
JwtToken,User-Agent validation changes
ravishanigarapu May 22, 2025
30f7b62
null check
ravishanigarapu May 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 4 additions & 12 deletions src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,7 @@
import com.iemr.admin.repository.rolemaster.M_UserservicerolemappingForRoleProviderAdminRepo;
import com.iemr.admin.service.user.EncryptUserPassword;
import com.iemr.admin.utils.CookieUtil;
import com.iemr.admin.utils.RestTemplateUtil;
import com.iemr.admin.utils.config.ConfigProperties;
import com.iemr.admin.utils.exception.IEMRException;
import com.iemr.admin.utils.http.HttpUtils;
Expand Down Expand Up @@ -462,17 +463,11 @@ private void updateSupervisorRoleInCTI(List<M_UserServiceRoleMapping2> resList1,
private Set<String> getCTICampaignRoles(String campaignName, String authToken) throws JsonMappingException, JsonProcessingException {
RestTemplate restTemplate = new RestTemplate();
ObjectMapper objectMapper = new ObjectMapper();
HttpServletRequest requestHeader = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes())
.getRequest();
String jwtTokenFromCookie = cookieUtil.getJwtTokenFromCookie(requestHeader);
Set<String> resultSet = new HashSet<String>();
MultiValueMap<String, String> headers = new LinkedMultiValueMap<String, String>();
headers.add("Content-Type", "application/json");
headers.add("AUTHORIZATION", authToken);
headers.add("Jwttoken", jwtTokenFromCookie);
HttpEntity<Object> request = RestTemplateUtil.createRequestEntity(campaignName, authToken);
String url = configProperties.getPropertyByName("common-url") + configProperties.getPropertyByName("create-feedback");
HttpEntity<Object> request1 = new HttpEntity<Object>(campaignName, headers);
ResponseEntity<String> responseStr = restTemplate.exchange(url, HttpMethod.POST, request1, String.class);

ResponseEntity<String> responseStr = restTemplate.exchange(url, HttpMethod.POST, request, String.class);
Comment on lines +467 to +470
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Good refactoring using centralized HTTP request entity creation

The refactoring simplifies the code by leveraging the new RestTemplateUtil.createRequestEntity method, which centralizes HTTP request construction and improves consistency by ensuring all necessary headers are included. This change removes duplicate code and makes the implementation more maintainable.

However, the URL being used appears to be for creating feedback but is used in a method for getting CTI campaign roles. Verify that this is the correct endpoint:

🏁 Script executed:

#!/bin/bash
# Verify the URL endpoint being used
echo "Method: getCTICampaignRoles"
echo "URL being used: ${configProperties.getPropertyByName('common-url')} + ${configProperties.getPropertyByName('create-feedback')}"
echo "Is this correct for retrieving campaign roles?"

Length of output: 383

🏁 Script executed:

#!/bin/bash
# Show context around the getCTICampaignRoles method
rg -n -B3 -A10 "getCTICampaignRoles" --color=never src/main/java

# Search for the 'create-feedback' key in all .properties files
rg -n "create-feedback" -g "*.properties"

# Search for any 'campaign' keys (to find the roles endpoint) in all .properties files
rg -n "campaign" -g "*.properties"

Length of output: 4265

Fix endpoint property key in getCTICampaignRoles

The code is using the undefined "create-feedback" property for fetching campaign roles. Use the "campaign-roles-url" key defined in application.properties instead.

  • File: src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java, line 468
- String url = configProperties.getPropertyByName("common-url")  + configProperties.getPropertyByName("create-feedback");
+ String url = configProperties.getPropertyByName("common-url")  + configProperties.getPropertyByName("campaign-roles-url");
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
HttpEntity<Object> request = RestTemplateUtil.createRequestEntity(campaignName, authToken);
String url = configProperties.getPropertyByName("common-url") + configProperties.getPropertyByName("create-feedback");
HttpEntity<Object> request1 = new HttpEntity<Object>(campaignName, headers);
ResponseEntity<String> responseStr = restTemplate.exchange(url, HttpMethod.POST, request1, String.class);
ResponseEntity<String> responseStr = restTemplate.exchange(url, HttpMethod.POST, request, String.class);
HttpEntity<Object> request = RestTemplateUtil.createRequestEntity(campaignName, authToken);
String url = configProperties.getPropertyByName("common-url") + configProperties.getPropertyByName("campaign-roles-url");
ResponseEntity<String> responseStr = restTemplate.exchange(url, HttpMethod.POST, request, String.class);
🤖 Prompt for AI Agents 
In
src/main/java/com/iemr/admin/service/employeemaster/EmployeeMasterServiceImpl.java
around lines 467 to 470, the URL for the REST call incorrectly uses the
"create-feedback" property key, which is meant for feedback creation, not for
fetching CTI campaign roles. Replace the property key "create-feedback" with the
correct "campaign-roles-url" key from application.properties to ensure the
endpoint matches the method's purpose.

OutputResponse response = objectMapper.readValue(responseStr.getBody(), OutputResponse.class);
if (response.isSuccess()) {
JSONObject obj = new JSONObject(response.getData());
Expand All @@ -481,9 +476,6 @@ private Set<String> getCTICampaignRoles(String campaignName, String authToken) t
resultSet.add(roles.getString(roleIndex));
}
}
// JSONObject request = new JSONObject();
// request.put("campaign", campaignName);

return resultSet;
}

Expand Down
13 changes: 10 additions & 3 deletions src/main/java/com/iemr/admin/utils/CookieUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,15 @@ public Optional<String> getCookieValue(HttpServletRequest request, String cookie
return Optional.empty();
}

public String getJwtTokenFromCookie(HttpServletRequest request) {
return Arrays.stream(request.getCookies()).filter(cookie -> "Jwttoken".equals(cookie.getName()))
.map(Cookie::getValue).findFirst().orElse(null);
public static String getJwtTokenFromCookie(HttpServletRequest request) {
Cookie[] cookies = request.getCookies();
if (cookies == null) {
return null; // No cookies present, return null safely
}
return Arrays.stream(cookies)
.filter(cookie -> "Jwttoken".equals(cookie.getName()))
.map(Cookie::getValue)
.findFirst()
.orElse(null);
}
}
34 changes: 23 additions & 11 deletions src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;

import com.iemr.admin.utils.http.AuthorizationHeaderRequestWrapper;

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
Expand Down Expand Up @@ -72,25 +74,35 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
if (jwtFromCookie != null) {
logger.info("Validating JWT token from cookie");
if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromCookie)) {
filterChain.doFilter(servletRequest, servletResponse);
AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper(
request, "");
filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse);
return;
}
}

if (jwtFromHeader != null) {
} else if (jwtFromHeader != null) {
logger.info("Validating JWT token from header");
if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromHeader)) {
filterChain.doFilter(servletRequest, servletResponse);
AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper(
request, "");
filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse);
return;
}
} else {
String userAgent = request.getHeader("User-Agent");
logger.info("User-Agent: " + userAgent);
if (userAgent != null && isMobileClient(userAgent) && authHeader != null) {
try {
UserAgentContext.setUserAgent(userAgent);
filterChain.doFilter(servletRequest, servletResponse);
} finally {
UserAgentContext.clear();
}
return;
}
}
String userAgent = request.getHeader("User-Agent");
logger.info("User-Agent: " + userAgent);

if (userAgent != null && isMobileClient(userAgent) && authHeader != null) {
filterChain.doFilter(servletRequest, servletResponse);
return;
}
logger.warn("No valid authentication token found");
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token");
Comment on lines +104 to +105
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Duplicate error message

There's a duplicate error message at lines 104-105 and 107-108. One of these blocks should be removed to avoid redundant logging and response.

-			logger.warn("No valid authentication token found");
-			response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token");

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In src/main/java/com/iemr/admin/utils/JwtUserIdValidationFilter.java around
lines 104 to 105, there is a duplicate error message block that repeats again at
lines 107 to 108. Remove one of these duplicate blocks to avoid redundant
logging and sending the same error response twice, ensuring only a single
warning log and error response is sent for invalid or missing authentication
tokens.


logger.warn("No valid authentication token found");
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token");
Expand Down
50 changes: 50 additions & 0 deletions src/main/java/com/iemr/admin/utils/RestTemplateUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
package com.iemr.admin.utils;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import jakarta.servlet.http.HttpServletRequest;

public class RestTemplateUtil {
private final static Logger logger = LoggerFactory.getLogger(RestTemplateUtil.class);

public static HttpEntity<Object> createRequestEntity(Object body, String authorization) {

ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes());
if (servletRequestAttributes == null) {
MultiValueMap<String, String> headers = new LinkedMultiValueMap<>();
headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8");
headers.add(HttpHeaders.AUTHORIZATION, authorization);
return new HttpEntity<>(body, headers);
}
HttpServletRequest requestHeader = servletRequestAttributes.getRequest();
String jwtTokenFromCookie = null;
try {
jwtTokenFromCookie = CookieUtil.getJwtTokenFromCookie(requestHeader);

} catch (Exception e) {
logger.error("Error while getting jwtToken from Cookie" + e.getMessage() );
}

MultiValueMap<String, String> headers = new LinkedMultiValueMap<>();
headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8");
if(null != UserAgentContext.getUserAgent()) {
headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent());
}
headers.add(HttpHeaders.AUTHORIZATION, authorization);
headers.add("JwtToken",requestHeader.getHeader("JwtToken"));
if(null != jwtTokenFromCookie) {
headers.add(HttpHeaders.COOKIE, "Jwttoken=" + jwtTokenFromCookie);
}

return new HttpEntity<>(body, headers);
}

}
18 changes: 18 additions & 0 deletions src/main/java/com/iemr/admin/utils/UserAgentContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
package com.iemr.admin.utils;

public class UserAgentContext {
private static final ThreadLocal<String> userAgentHolder = new ThreadLocal<>();

public static void setUserAgent(String userAgent) {
userAgentHolder.set(userAgent);
}

public static String getUserAgent() {
return userAgentHolder.get();
}

public static void clear() {
userAgentHolder.remove();
}

}
43 changes: 43 additions & 0 deletions src/main/java/com/iemr/admin/utils/http/AuthorizationHeaderRequestWrapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
package com.iemr.admin.utils.http;

import java.util.Collections;
import java.util.Enumeration;
import java.util.List;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequestWrapper;

public class AuthorizationHeaderRequestWrapper extends HttpServletRequestWrapper{
private final String Authorization;

public AuthorizationHeaderRequestWrapper(HttpServletRequest request, String authHeaderValue) {
super(request);
this.Authorization = authHeaderValue;
}

@Override
public String getHeader(String name) {
if ("Authorization".equalsIgnoreCase(name)) {
return Authorization;
}
return super.getHeader(name);
}

@Override
public Enumeration<String> getHeaders(String name) {
if ("Authorization".equalsIgnoreCase(name)) {
return Collections.enumeration(Collections.singletonList(Authorization));
}
return super.getHeaders(name);
}

@Override
public Enumeration<String> getHeaderNames() {
List<String> names = Collections.list(super.getHeaderNames());
if (!names.contains("Authorization")) {
names.add("Authorization");
}
return Collections.enumeration(names);
}
}

4 changes: 4 additions & 0 deletions src/main/java/com/iemr/admin/utils/http/HTTPRequestInterceptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,10 @@ public boolean preHandle(HttpServletRequest request, HttpServletResponse respons
authorization=preAuth.replace("Bearer ", "");
else
authorization = preAuth;
if (authorization == null || authorization.isEmpty()) {
logger.info("Authorization header is null or empty. Skipping HTTPRequestInterceptor.");
return true; // Allow the request to proceed without validation
}
if (!request.getMethod().equalsIgnoreCase("OPTIONS")) {
try {
String[] requestURIParts = request.getRequestURI().split("/");
Expand Down
Loading